@stigmer/sdk 0.0.72 → 0.0.74

package/src/authorization-config.ts

@@ -0,0 +1,42 @@
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { GRANTABLE_ROLES } from "./gen/authorization-config";
+
+const EMPTY_ROLES: readonly IamRole[] = Object.freeze([]);
+
+/**
+ * Returns the roles that can be granted on the given resource kind
+ * via IAM policies.
+ *
+ * An empty array means no user-grantable roles exist — the resource is
+ * either owner-only, inherits authorization from a parent, is self-owned,
+ * or has no authorization.
+ */
+export function getGrantableRoles(
+  kind: ApiResourceKind,
+): readonly IamRole[] {
+  return GRANTABLE_ROLES.get(kind) ?? EMPTY_ROLES;
+}
+
+/**
+ * Whether the given resource kind has at least one user-grantable role.
+ */
+export function hasGrantableRoles(kind: ApiResourceKind): boolean {
+  const roles = GRANTABLE_ROLES.get(kind);
+  return roles !== undefined && roles.length > 0;
+}
+
+/**
+ * Whether the given role can be granted on the given resource kind.
+ *
+ * Use this for client-side pre-validation before calling
+ * `iamPolicy.create()` — it mirrors the backend's
+ * `ValidateGrantableRole` step.
+ */
+export function isRoleGrantable(
+  kind: ApiResourceKind,
+  role: IamRole,
+): boolean {
+  const roles = GRANTABLE_ROLES.get(kind);
+  return roles !== undefined && roles.includes(role);
+}

package/src/gen/agent.ts

@@ -85,6 +85,7 @@ export class AgentClient {
         query: params.query,
         org: params.org,
         excludePublic: params.excludePublic ?? false,
+        crossOrgPublic: params.crossOrgPublic ?? false,
         page: params.page ? create(PageInfoSchema, params.page) : undefined,
       }));
       return {

package/src/gen/authorization-config.ts

@@ -0,0 +1,29 @@
+// Code generated by stigmer-codegen from api_resource_kind.proto kind_meta. DO NOT EDIT.
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+/**
+ * Roles that can be granted on each resource kind via IAM policies.
+ *
+ * Source of truth: api_resource_kind.proto — each ApiResourceKind enum
+ * value carries an AuthorizationConfig with grantable_roles in its
+ * kind_meta options.
+ *
+ * Kinds not in this map have no user-grantable roles (system-managed,
+ * owner-only, inherited, or no authorization).
+ */
+export const GRANTABLE_ROLES: ReadonlyMap<ApiResourceKind, readonly IamRole[]> = new Map([
+  [ApiResourceKind.identity_provider, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.organization, [IamRole.owner, IamRole.admin, IamRole.member, IamRole.viewer]],
+  [ApiResourceKind.agent, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.session, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.skill, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.mcp_server, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.agent_instance, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.workflow, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.workflow_instance, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.workflow_execution, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.environment, [IamRole.owner, IamRole.viewer]],
+  [ApiResourceKind.project, [IamRole.owner, IamRole.viewer]],
+]);

package/src/gen/client.ts

@@ -10,6 +10,7 @@ import { ExecutionContextClient } from "./executioncontext";
 import { IamPolicyClient } from "./iampolicy";
 import { IdentityAccountClient } from "./identityaccount";
 import { IdentityProviderClient } from "./identityprovider";
+import { InvitationClient } from "./invitation";
 import { McpServerClient } from "./mcpserver";
 import { OrganizationClient } from "./organization";
 import { ProjectClient } from "./project";
@@ -30,6 +31,7 @@ export class GeneratedClient {
   readonly iamPolicy: IamPolicyClient;
   readonly identityAccount: IdentityAccountClient;
   readonly identityProvider: IdentityProviderClient;
+  readonly invitation: InvitationClient;
   readonly mcpServer: McpServerClient;
   readonly organization: OrganizationClient;
   readonly project: ProjectClient;
@@ -49,6 +51,7 @@ export class GeneratedClient {
     this.iamPolicy = new IamPolicyClient(transport);
     this.identityAccount = new IdentityAccountClient(transport);
     this.identityProvider = new IdentityProviderClient(transport);
+    this.invitation = new InvitationClient(transport);
     this.mcpServer = new McpServerClient(transport);
     this.organization = new OrganizationClient(transport);
     this.project = new ProjectClient(transport);
@@ -79,8 +82,10 @@ export { IdentityAccountClient } from "./identityaccount";
 export { type IdentityAccountInput } from "./identityaccount";
 export { IdentityProviderClient } from "./identityprovider";
 export { type IdentityProviderInput } from "./identityprovider";
+export { InvitationClient } from "./invitation";
+export { type InvitationInput } from "./invitation";
 export { McpServerClient } from "./mcpserver";
-export { type McpServerInput, type StdioServerConfigInput, type HttpServerConfigInput, type ToolApprovalPolicyInput } from "./mcpserver";
+export { type McpServerInput, type StdioServerConfigInput, type HttpServerConfigInput, type McpServerSourceInput, type ToolApprovalPolicyInput } from "./mcpserver";
 export { OrganizationClient } from "./organization";
 export { type OrganizationInput } from "./organization";
 export { ProjectClient } from "./project";

package/src/gen/iampolicy.ts

@@ -7,7 +7,7 @@ import { createClient, type Client, type Transport } from "@connectrpc/connect";
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import { IamPolicySchema, type IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 import { IamPolicyCommandController } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/command_pb";
-import { IamPolicyIdSchema, CheckAuthorizationInputSchema, CheckAuthorizationResultSchema, ListAuthorizedResourceIdsInputSchema, AuthorizedResourceIdsListSchema, ListAuthorizedPrincipalIdsInputSchema, AuthorizedPrincipalIdsListSchema, type CheckAuthorizationInput, type CheckAuthorizationResult, type ListAuthorizedResourceIdsInput, type AuthorizedResourceIdsList, type ListAuthorizedPrincipalIdsInput, type AuthorizedPrincipalIdsList } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
+import { IamPolicyIdSchema, RevokeOrgAccessInputSchema, CheckAuthorizationInputSchema, CheckAuthorizationResultSchema, ListAuthorizedResourceIdsInputSchema, AuthorizedResourceIdsListSchema, ListAuthorizedPrincipalIdsInputSchema, AuthorizedPrincipalIdsListSchema, ListResourceAccessInputSchema, ResourceAccessByPrincipalListSchema, PrincipalResourceInputSchema, PrincipalResourceRolesSchema, GetPrincipalsCountInputSchema, PrincipalsCountSchema, type RevokeOrgAccessInput, type CheckAuthorizationInput, type CheckAuthorizationResult, type ListAuthorizedResourceIdsInput, type AuthorizedResourceIdsList, type ListAuthorizedPrincipalIdsInput, type AuthorizedPrincipalIdsList, type ListResourceAccessInput, type ResourceAccessByPrincipalList, type PrincipalResourceInput, type PrincipalResourceRoles, type GetPrincipalsCountInput, type PrincipalsCount } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
 import { IamPolicyQueryController } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/query_pb";
 import { ApiResourceRefSchema, IamPolicySpecSchema, type IamPolicySpec, type ApiResourceRef } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 
@@ -45,6 +45,12 @@ export class IamPolicyClient {
     } catch (e) { throw wrapError(e); }
   }
 
+  async revokeOrgAccess(input: RevokeOrgAccessInput): Promise<void> {
+    try {
+      await this.command.revokeOrgAccess(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
   async get(id: string): Promise<IamPolicy> {
     try {
       return await this.query.get(create(IamPolicyIdSchema, { value: id }));
@@ -68,6 +74,24 @@ export class IamPolicyClient {
       return await this.query.listAuthorizedPrincipalIds(input);
     } catch (e) { throw wrapError(e); }
   }
+
+  async listResourceAccessByPrincipal(input: ListResourceAccessInput): Promise<ResourceAccessByPrincipalList> {
+    try {
+      return await this.query.listResourceAccessByPrincipal(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async getPrincipalResourceRoles(input: PrincipalResourceInput): Promise<PrincipalResourceRoles> {
+    try {
+      return await this.query.getPrincipalResourceRoles(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async getPrincipalsCount(input: GetPrincipalsCountInput): Promise<PrincipalsCount> {
+    try {
+      return await this.query.getPrincipalsCount(input);
+    } catch (e) { throw wrapError(e); }
+  }
 }
 
 /** Input for creating/updating a IamPolicy. */

package/src/gen/identityaccount.ts

@@ -12,7 +12,7 @@ import { type ApiResourceAuditActor } from "@stigmer/protos/ai/stigmer/commons/a
 import { IdentityAccountSchema, type IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/command_pb";
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
-import { IdentityAccountIdSchema, IdentityAccountEmailSchema, IdpIdSchema, type IdentityAccountEmail } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/io_pb";
+import { IdentityAccountIdSchema, CreateFederatedAccountInputSchema, UpdateFederatedAccountInputSchema, DeprovisionFederatedAccountInputSchema, IdentityAccountEmailSchema, IdpIdSchema, ExternalSubLookupSchema, type CreateFederatedAccountInput, type UpdateFederatedAccountInput, type DeprovisionFederatedAccountInput, type IdentityAccountEmail, type ExternalSubLookup } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/io_pb";
 import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
 import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
 
@@ -44,6 +44,24 @@ export class IdentityAccountClient {
     } catch (e) { throw wrapError(e); }
   }
 
+  async createFederatedAccount(input: CreateFederatedAccountInput): Promise<IdentityAccount> {
+    try {
+      return await this.command.createFederatedAccount(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async updateFederatedAccount(input: UpdateFederatedAccountInput): Promise<IdentityAccount> {
+    try {
+      return await this.command.updateFederatedAccount(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async deprovisionFederatedAccount(input: DeprovisionFederatedAccountInput): Promise<IdentityAccount> {
+    try {
+      return await this.command.deprovisionFederatedAccount(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
   async simulateSignupWebhook(input: IdentityAccountEmail): Promise<void> {
     try {
       await this.command.simulateSignupWebhook(input);
@@ -74,6 +92,12 @@ export class IdentityAccountClient {
     } catch (e) { throw wrapError(e); }
   }
 
+  async getByExternalSub(input: ExternalSubLookup): Promise<IdentityAccount> {
+    try {
+      return await this.query.getByExternalSub(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
   async getActorInfo(id: string): Promise<ApiResourceAuditActor> {
     try {
       return await this.query.getActorInfo(create(IdentityAccountIdSchema, { value: id }));

package/src/gen/identityprovider.ts

@@ -10,6 +10,7 @@ import { ApiResourceIdSchema, ApiResourceReferenceSchema, ApiResourceDeleteInput
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import { IdentityProviderSchema, type IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
 import { IdentityProviderCommandController } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/command_pb";
+import { ListIdentityProvidersByOrgInputSchema, IdentityProvidersSchema, OrganizationSsoLookupSchema, SsoProviderInfoSchema, type ListIdentityProvidersByOrgInput, type IdentityProviders, type OrganizationSsoLookup, type SsoProviderInfo } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/io_pb";
 import { IdentityProviderQueryController } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/query_pb";
 import { IdentityProviderSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/spec_pb";
 
@@ -62,6 +63,18 @@ export class IdentityProviderClient {
       return await this.query.getByReference(create(ApiResourceReferenceSchema, { ...ref, kind: ApiResourceKind.identity_provider }));
     } catch (e) { throw wrapError(e); }
   }
+
+  async listByOrg(input: ListIdentityProvidersByOrgInput): Promise<IdentityProviders> {
+    try {
+      return await this.query.listByOrg(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async getSsoProvider(input: OrganizationSsoLookup): Promise<SsoProviderInfo> {
+    try {
+      return await this.query.getSsoProvider(input);
+    } catch (e) { throw wrapError(e); }
+  }
 }
 
 /** Input for creating/updating a IdentityProvider. */
@@ -76,6 +89,8 @@ export interface IdentityProviderInput {
   expectedAudience?: string;
   rateLimitBudget?: number;
   userinfoEndpoint?: string;
+  isSsoProvider?: boolean;
+  oidcClientId?: string;
 }
 
 function buildIdentityProviderProto(input: IdentityProviderInput): IdentityProvider {
@@ -95,6 +110,8 @@ function buildIdentityProviderProto(input: IdentityProviderInput): IdentityProvi
       expectedAudience: input.expectedAudience,
       rateLimitBudget: input.rateLimitBudget,
       userinfoEndpoint: input.userinfoEndpoint,
+      isSsoProvider: input.isSsoProvider,
+      oidcClientId: input.oidcClientId,
     })),
   }) as IdentityProvider;
 }

package/src/gen/invitation.ts

@@ -0,0 +1,91 @@
+// Code generated by stigmer-codegen. DO NOT EDIT.
+
+import { wrapError } from "./errors";
+import { stripUndefined } from "./proto-utils";
+import { create } from "@bufbuild/protobuf";
+import { createClient, type Client, type Transport } from "@connectrpc/connect";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import { InvitationSchema, type Invitation } from "@stigmer/protos/ai/stigmer/iam/invitation/v1/api_pb";
+import { InvitationCommandController } from "@stigmer/protos/ai/stigmer/iam/invitation/v1/command_pb";
+import { InvitationIdSchema, RedeemInvitationInputSchema, ListInvitationsByOrgInputSchema, InvitationsSchema, InvitationTokenInputSchema, InvitationPreviewSchema, type RedeemInvitationInput, type ListInvitationsByOrgInput, type Invitations, type InvitationTokenInput, type InvitationPreview } from "@stigmer/protos/ai/stigmer/iam/invitation/v1/io_pb";
+import { InvitationQueryController } from "@stigmer/protos/ai/stigmer/iam/invitation/v1/query_pb";
+import { InvitationSpecSchema } from "@stigmer/protos/ai/stigmer/iam/invitation/v1/spec_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+/** Provides operations on invitation resources. */
+export class InvitationClient {
+  private readonly command: Client<typeof InvitationCommandController>;
+  private readonly query: Client<typeof InvitationQueryController>;
+
+  constructor(transport: Transport) {
+    this.command = createClient(InvitationCommandController, transport);
+    this.query = createClient(InvitationQueryController, transport);
+  }
+
+  async create(input: InvitationInput): Promise<Invitation> {
+    try {
+      return await this.command.create(buildInvitationProto(input));
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async revoke(id: string): Promise<Invitation> {
+    try {
+      return await this.command.revoke(create(InvitationIdSchema, { value: id }));
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async redeem(input: RedeemInvitationInput): Promise<Invitation> {
+    try {
+      return await this.command.redeem(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async get(id: string): Promise<Invitation> {
+    try {
+      return await this.query.get(create(InvitationIdSchema, { value: id }));
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async listByOrg(input: ListInvitationsByOrgInput): Promise<Invitations> {
+    try {
+      return await this.query.listByOrg(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async getByToken(input: InvitationTokenInput): Promise<InvitationPreview> {
+    try {
+      return await this.query.getByToken(input);
+    } catch (e) { throw wrapError(e); }
+  }
+}
+
+/** Input for creating/updating a Invitation. */
+export interface InvitationInput {
+  name: string;
+  slug?: string;
+  org: string;
+  labels?: Record<string, string>;
+  role: IamRole;
+  maxRedemptions?: number;
+  expiresAt: Date | string;
+  label?: string;
+}
+
+function buildInvitationProto(input: InvitationInput): Invitation {
+  return Object.assign(create(InvitationSchema), {
+    apiVersion: "iam.stigmer.ai/v1",
+    kind: "Invitation",
+    metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      name: input.name,
+      org: input.org,
+      ...(input.slug && { slug: input.slug }),
+      ...(input.labels && { labels: input.labels }),
+    }),
+    spec: Object.assign(create(InvitationSpecSchema), stripUndefined({
+      role: input.role,
+      maxRedemptions: input.maxRedemptions,
+      expiresAt: input.expiresAt,
+      label: input.label,
+    })),
+  }) as Invitation;
+}

package/src/gen/mcpserver.ts

@@ -8,9 +8,9 @@ import { createClient, type Client, type Transport } from "@connectrpc/connect";
 import { EnvironmentSpecSchema, EnvironmentValueSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
 import { McpServerSchema, type McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
-import { UpdateDiscoveredCapabilitiesInputSchema, DiscoverCapabilitiesInputSchema, type UpdateDiscoveredCapabilitiesInput, type DiscoverCapabilitiesInput } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import { ConnectInputSchema, type ConnectInput } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
 import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
-import { McpServerSpecSchema, StdioServerConfigSchema, HttpServerConfigSchema, ToolApprovalPolicySchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import { McpServerSpecSchema, StdioServerConfigSchema, HttpServerConfigSchema, McpServerSourceSchema, ToolApprovalPolicySchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceIdSchema, ApiResourceReferenceSchema, ApiResourceDeleteInputSchema, type UpdateVisibilityInput } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
@@ -64,15 +64,9 @@ export class McpServerClient {
     } catch (e) { throw wrapError(e); }
   }
 
-  async updateDiscoveredCapabilities(input: UpdateDiscoveredCapabilitiesInput): Promise<McpServer> {
+  async connect(input: ConnectInput): Promise<McpServer> {
     try {
-      return await this.command.updateDiscoveredCapabilities(input);
-    } catch (e) { throw wrapError(e); }
-  }
-
-  async discoverCapabilities(input: DiscoverCapabilitiesInput): Promise<McpServer> {
-    try {
-      return await this.command.discoverCapabilities(input);
+      return await this.command.connect(input);
     } catch (e) { throw wrapError(e); }
   }
 
@@ -95,6 +89,7 @@ export class McpServerClient {
         query: params.query,
         org: params.org,
         excludePublic: params.excludePublic ?? false,
+        crossOrgPublic: params.crossOrgPublic ?? false,
         page: params.page ? create(PageInfoSchema, params.page) : undefined,
       }));
       return {
@@ -118,7 +113,8 @@ export interface McpServerInput {
   http?: HttpServerConfigInput;
   defaultEnabledTools?: string[];
   envSpec?: EnvSpecInput;
-  defaultToolApprovals?: ToolApprovalPolicyInput[];
+  source?: McpServerSourceInput;
+  pinnedToolApprovals?: ToolApprovalPolicyInput[];
 }
 
 /** SDK input type for StdioServerConfig. */
@@ -136,6 +132,15 @@ export interface HttpServerConfigInput {
   timeoutSeconds?: number;
 }
 
+/** SDK input type for McpServerSource. */
+export interface McpServerSourceInput {
+  registry?: string;
+  registryName?: string;
+  version?: string;
+  repositoryUrl?: string;
+  lastSyncedAt?: Date | string;
+}
+
 /** SDK input type for ToolApprovalPolicy. */
 export interface ToolApprovalPolicyInput {
   toolName?: string;
@@ -159,6 +164,16 @@ function buildHttpServerConfigProto(input: HttpServerConfigInput) {
   }));
 }
 
+function buildMcpServerSourceProto(input: McpServerSourceInput) {
+  return Object.assign(create(McpServerSourceSchema), stripUndefined({
+    registry: input.registry,
+    registryName: input.registryName,
+    version: input.version,
+    repositoryUrl: input.repositoryUrl,
+    lastSyncedAt: input.lastSyncedAt,
+  }));
+}
+
 function buildToolApprovalPolicyProto(input: ToolApprovalPolicyInput) {
   return Object.assign(create(ToolApprovalPolicySchema), stripUndefined({
     toolName: input.toolName,
@@ -175,13 +190,15 @@ function buildMcpServerProto(input: McpServerInput): McpServer {
     }
     envSpec = es;
   }
-  const defaultToolApprovals = input.defaultToolApprovals?.map(buildToolApprovalPolicyProto);
+  const source = input.source ? buildMcpServerSourceProto(input.source) : undefined;
+  const pinnedToolApprovals = input.pinnedToolApprovals?.map(buildToolApprovalPolicyProto);
   const spec = Object.assign(create(McpServerSpecSchema), stripUndefined({
     description: input.description,
     iconUrl: input.iconUrl,
     defaultEnabledTools: input.defaultEnabledTools,
     envSpec,
-    defaultToolApprovals,
+    source,
+    pinnedToolApprovals,
   }));
   if (input.stdio) {
     spec.serverType = { case: "stdio", value: buildStdioServerConfigProto(input.stdio) };

package/src/gen/resource-availability.ts

@@ -0,0 +1,19 @@
+// Code generated by stigmer-codegen from api_resource_kind.proto kind_meta. DO NOT EDIT.
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+/**
+ * Resource kinds whose proto kind_meta.tier is cloud_only.
+ *
+ * Source of truth: api_resource_kind.proto — each ApiResourceKind enum
+ * value carries a ResourceTier in its kind_meta options.
+ */
+export const CLOUD_ONLY_KINDS: ReadonlySet<ApiResourceKind> = new Set([
+  ApiResourceKind.api_resource_version,
+  ApiResourceKind.iam_policy,
+  ApiResourceKind.identity_account,
+  ApiResourceKind.api_key,
+  ApiResourceKind.invitation,
+  ApiResourceKind.identity_provider,
+  ApiResourceKind.platform,
+]);

package/src/gen/skill.ts

@@ -78,6 +78,7 @@ export class SkillClient {
         query: params.query,
         org: params.org,
         excludePublic: params.excludePublic ?? false,
+        crossOrgPublic: params.crossOrgPublic ?? false,
         page: params.page ? create(PageInfoSchema, params.page) : undefined,
       }));
       return {

package/src/gen/types.ts

@@ -28,6 +28,7 @@ export interface ListParams {
   readonly org: string;
   readonly query?: string;
   readonly excludePublic?: boolean;
+  readonly crossOrgPublic?: boolean;
   readonly page?: Page;
 }
 

package/src/iam-role.ts

@@ -0,0 +1,75 @@
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
+const ROLE_STRINGS: Record<IamRole, string> = {
+  [IamRole.iam_role_unspecified]: "unspecified",
+  [IamRole.owner]: "owner",
+  [IamRole.admin]: "admin",
+  [IamRole.member]: "member",
+  [IamRole.viewer]: "viewer",
+};
+
+const STRING_TO_ROLE: Record<string, IamRole> = {
+  owner: IamRole.owner,
+  admin: IamRole.admin,
+  member: IamRole.member,
+  viewer: IamRole.viewer,
+};
+
+const ROLE_DISPLAY_NAMES: Record<IamRole, string> = {
+  [IamRole.iam_role_unspecified]: "Unspecified",
+  [IamRole.owner]: "Owner",
+  [IamRole.admin]: "Admin",
+  [IamRole.member]: "Member",
+  [IamRole.viewer]: "Viewer",
+};
+
+const ROLE_DESCRIPTIONS: Record<IamRole, string> = {
+  [IamRole.iam_role_unspecified]: "",
+  [IamRole.owner]: "Full access including delete and access management",
+  [IamRole.admin]: "Edit access and member management",
+  [IamRole.member]: "Standard access to organization resources",
+  [IamRole.viewer]: "Read-only access",
+};
+
+/**
+ * Converts an IamRole enum value to its FGA relation string.
+ *
+ * This is the string used in `IamPolicySpec.relation` when creating
+ * or deleting IAM policies.
+ *
+ * @example iamRoleToString(IamRole.admin) // "admin"
+ */
+export function iamRoleToString(role: IamRole): string {
+  return ROLE_STRINGS[role] ?? "unspecified";
+}
+
+/**
+ * Parses an FGA relation string to an IamRole enum value.
+ *
+ * Returns `undefined` for unrecognized strings.
+ *
+ * @example iamRoleFromString("admin") // IamRole.admin
+ */
+export function iamRoleFromString(s: string): IamRole | undefined {
+  return STRING_TO_ROLE[s];
+}
+
+/**
+ * Human-readable display name for an IamRole.
+ *
+ * @example iamRoleDisplayName(IamRole.admin) // "Admin"
+ */
+export function iamRoleDisplayName(role: IamRole): string {
+  return ROLE_DISPLAY_NAMES[role] ?? "Unknown";
+}
+
+/**
+ * Short description of what the role grants.
+ *
+ * Suitable for tooltips and helper text in role selectors.
+ *
+ * @example iamRoleDescription(IamRole.viewer) // "Read-only access"
+ */
+export function iamRoleDescription(role: IamRole): string {
+  return ROLE_DESCRIPTIONS[role] ?? "";
+}

package/src/index.ts

@@ -30,6 +30,20 @@ export {
   isResourceAvailable,
 } from "./resource-availability";
 
+// Authorization config and IAM role utilities
+export {
+  getGrantableRoles,
+  hasGrantableRoles,
+  isRoleGrantable,
+} from "./authorization-config";
+export {
+  iamRoleToString,
+  iamRoleFromString,
+  iamRoleDisplayName,
+  iamRoleDescription,
+} from "./iam-role";
+export { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+
 // Search client
 export {
   SearchClient,
@@ -96,6 +110,10 @@ export {
   IdentityAccountClient,
   type IdentityAccountInput,
 } from "./gen/identityaccount";
+export {
+  InvitationClient,
+  type InvitationInput,
+} from "./gen/invitation";
 export {
   IdentityProviderClient,
   type IdentityProviderInput,

package/src/resource-availability.ts

@@ -1,4 +1,5 @@
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { CLOUD_ONLY_KINDS } from "./gen/resource-availability";
 
 /**
  * Deployment mode of the Stigmer backend the client is connected to.
@@ -10,26 +11,6 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
  */
 export type DeploymentMode = "local" | "cloud";
 
-/**
- * Resource kinds whose proto `kind_meta.tier` is `cloud_only`.
- *
- * Source of truth: `api_resource_kind.proto` — each `ApiResourceKind` enum
- * value carries a `ResourceTier` in its `kind_meta` options. This set
- * mirrors those values statically so the SDK avoids runtime proto
- * descriptor reflection.
- *
- * When a new resource kind is added with `tier: cloud_only` in the proto,
- * add it here as well.
- */
-const CLOUD_ONLY_KINDS: ReadonlySet<ApiResourceKind> = new Set([
-  ApiResourceKind.api_resource_version,
-  ApiResourceKind.iam_policy,
-  ApiResourceKind.identity_account,
-  ApiResourceKind.api_key,
-  ApiResourceKind.identity_provider,
-  ApiResourceKind.platform,
-]);
-
 /**
  * Check whether a resource kind is available in the given deployment mode.
  *

package/src/stigmer.ts

@@ -16,6 +16,7 @@ import type { ExecutionContextClient } from "./gen/executioncontext";
 import type { IamPolicyClient } from "./gen/iampolicy";
 import type { IdentityAccountClient } from "./gen/identityaccount";
 import type { IdentityProviderClient } from "./gen/identityprovider";
+import type { InvitationClient } from "./gen/invitation";
 import type { McpServerClient } from "./gen/mcpserver";
 import type { OrganizationClient } from "./gen/organization";
 import type { ProjectClient } from "./gen/project";
@@ -60,6 +61,7 @@ export class Stigmer {
   readonly iamPolicy: IamPolicyClient;
   readonly identityAccount: IdentityAccountClient;
   readonly identityProvider: IdentityProviderClient;
+  readonly invitation: InvitationClient;
   readonly mcpServer: McpServerClient;
   readonly organization: OrganizationClient;
   readonly project: ProjectClient;
@@ -93,6 +95,7 @@ export class Stigmer {
     this.iamPolicy = client.iamPolicy;
     this.identityAccount = client.identityAccount;
     this.identityProvider = client.identityProvider;
+    this.invitation = client.invitation;
     this.mcpServer = client.mcpServer;
     this.organization = client.organization;
     this.project = client.project;