@stigmer/sdk 0.0.86 → 0.0.88

package/__tests__/node.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=node.test.d.ts.map

package/__tests__/node.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/node.test.ts"],"names":[],"mappings":""}

package/__tests__/node.test.js

@@ -0,0 +1,52 @@
+import { describe, it, expect } from "vitest";
+import { createNodeClient, createNodeTransport } from "../node";
+describe("createNodeTransport", () => {
+    it("creates a transport with an API key", () => {
+        const transport = createNodeTransport({
+            baseUrl: "https://api.stigmer.ai",
+            apiKey: "sk_test_123",
+        });
+        expect(transport).toBeDefined();
+    });
+    it("creates a transport with a token provider", () => {
+        const transport = createNodeTransport({
+            baseUrl: "https://api.stigmer.ai",
+            getAccessToken: () => "token_abc",
+        });
+        expect(transport).toBeDefined();
+    });
+    it("creates a transport without auth", () => {
+        const transport = createNodeTransport({
+            baseUrl: "https://api.stigmer.ai",
+        });
+        expect(transport).toBeDefined();
+    });
+});
+describe("createNodeClient", () => {
+    it("creates a Stigmer client with API key", () => {
+        const client = createNodeClient({
+            baseUrl: "https://api.stigmer.ai",
+            apiKey: "sk_test_123",
+        });
+        expect(client).toBeDefined();
+        expect(client.baseUrl).toBe("https://api.stigmer.ai");
+    });
+    it("creates a Stigmer client with token provider", () => {
+        const client = createNodeClient({
+            baseUrl: "https://api.stigmer.ai",
+            getAccessToken: () => "token_abc",
+        });
+        expect(client).toBeDefined();
+        expect(client.baseUrl).toBe("https://api.stigmer.ai");
+    });
+    it("exposes resource sub-clients", () => {
+        const client = createNodeClient({
+            baseUrl: "https://api.stigmer.ai",
+            apiKey: "sk_test_123",
+        });
+        expect(client.agent).toBeDefined();
+        expect(client.session).toBeDefined();
+        expect(client.agentExecution).toBeDefined();
+    });
+});
+//# sourceMappingURL=node.test.js.map

package/__tests__/node.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.test.js","sourceRoot":"","sources":["../../src/__tests__/node.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEhE,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,SAAS,GAAG,mBAAmB,CAAC;YACpC,OAAO,EAAE,wBAAwB;YACjC,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,SAAS,GAAG,mBAAmB,CAAC;YACpC,OAAO,EAAE,wBAAwB;YACjC,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,SAAS,GAAG,mBAAmB,CAAC;YACpC,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC9B,OAAO,EAAE,wBAAwB;YACjC,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC9B,OAAO,EAAE,wBAAwB;YACjC,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC9B,OAAO,EAAE,wBAAwB;YACjC,MAAM,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/config.d.ts

@@ -1,3 +1,4 @@
+import type { Transport } from "@connectrpc/connect";
 /**
  * Token provider callback for dynamic authentication.
  * Called per-request, allowing token refresh and auth state changes.
@@ -7,9 +8,13 @@ export type TokenProvider = () => Promise<string | null> | string | null;
 /**
  * Configuration for the Stigmer SDK client.
  *
- * Exactly one of `apiKey` or `getAccessToken` must be provided:
- * - `apiKey`: Static API key for server-to-server usage.
- * - `getAccessToken`: Dynamic token provider for browser or rotating credentials.
+ * Authentication: exactly one of `apiKey` or `getAccessToken` must be
+ * provided (unless `customTransport` handles auth independently).
+ *
+ * Transport: by default the SDK creates a browser-oriented transport
+ * using `@connectrpc/connect-web`. Pass `customTransport` to use a
+ * pre-built transport — for example, `@connectrpc/connect-node` for
+ * server-side or CLI usage.
  */
 export interface StigmerConfig {
     /** Base URL of the Stigmer API server (e.g., "https://api.stigmer.ai"). */
@@ -29,9 +34,37 @@ export interface StigmerConfig {
      * - `"grpc-web"` (default): gRPC-Web binary protocol. Compact, battle-tested.
      * - `"connect"`: Connect protocol over HTTP/JSON. Easier to debug with standard HTTP tooling.
      *
-     * Both protocols are supported by the Stigmer server.
+     * Both protocols are supported by the Stigmer server. Ignored when
+     * `customTransport` is provided.
      */
     readonly transport?: "grpc-web" | "connect";
+    /**
+     * Pre-built ConnectRPC transport.
+     *
+     * When provided, the SDK uses this transport directly instead of
+     * creating one from `baseUrl`, `transport`, and the auth fields.
+     * This enables non-browser environments (Node.js CLIs, edge runtimes)
+     * to supply a transport with native HTTP/2 support via
+     * `@connectrpc/connect-node` or any other ConnectRPC transport.
+     *
+     * The caller is responsible for configuring auth interceptors on the
+     * custom transport; the SDK's built-in auth interceptor is bypassed.
+     *
+     * @example
+     * ```typescript
+     * import { createConnectTransport } from "@connectrpc/connect-node";
+     * import { Stigmer } from "@stigmer/sdk";
+     *
+     * const stigmer = new Stigmer({
+     *   baseUrl: "https://api.stigmer.ai",
+     *   customTransport: createConnectTransport({
+     *     baseUrl: "https://api.stigmer.ai",
+     *     httpVersion: "2",
+     *   }),
+     * });
+     * ```
+     */
+    readonly customTransport?: Transport;
 }
 /**
  * Validate a StigmerConfig and throw a descriptive error for invalid configurations.

package/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IAExC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,IAAI,CAAC;IAExC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;CAC7C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAmB1D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IAExC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,IAAI,CAAC;IAExC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,SAAS,CAAC;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC;CACtC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAyB1D"}

package/config.js

@@ -5,6 +5,11 @@ export function validateConfig(config) {
     if (!config.baseUrl) {
         throw new Error("stigmer: baseUrl is required");
     }
+    // When a custom transport is supplied, auth fields are optional — the
+    // caller is responsible for wiring auth interceptors on the transport.
+    if (config.customTransport) {
+        return;
+    }
     const hasApiKey = typeof config.apiKey === "string" && config.apiKey.length > 0;
     const hasTokenProvider = typeof config.getAccessToken === "function";
     if (!hasApiKey && !hasTokenProvider) {

package/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAyCA;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAChF,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC;IAErE,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA4EA;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAChF,MAAM,gBAAgB,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,UAAU,CAAC;IAErE,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,IAAI,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAQ,MAAM,qBAAqB,CAAC;AAIzD,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,EACd,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,aAAa,GACb,WAAW,GACX,SAAS,CAAC;AAmCd;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAQ3D;AAOD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAExD;AAyBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAOxE;AA0BD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAID;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,gBAAgB,GACzB,IAAI,CAEN;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAK3E"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAQ,MAAM,qBAAqB,CAAC;AAIzD,OAAO,EACL,YAAY,EACZ,KAAK,SAAS,EACd,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,aAAa,GACb,WAAW,GACX,SAAS,CAAC;AAmCd;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAQ3D;AAOD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAExD;AA2DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAOxE;AA6BD;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAID;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,gBAAgB,GACzB,IAAI,CAEN;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAK3E"}

package/errors.js

@@ -83,6 +83,39 @@ const CATEGORY_FALLBACKS = {
     cancelled: "The request was cancelled.",
     unknown: "An unexpected error occurred.",
 };
+/**
+ * Maps enriched auth error descriptions from the backend into developer-friendly
+ * guidance. These patterns match the actionable descriptions returned by the
+ * gRPC interceptor chain (GrpcSecurityConfigBase + GrpcRequestContextBuilderInterceptor).
+ */
+const AUTH_ERROR_PATTERNS = [
+    [
+        /token audience does not match/i,
+        "The token's audience does not match the IdentityProvider's expected_audience. " +
+            "Verify your Auth0 API identifier matches the expected_audience configured in Stigmer.",
+    ],
+    [
+        /token signature verification failed/i,
+        "Token signature verification failed. " +
+            "Check that the IdentityProvider's jwks_uri points to the correct JWKS endpoint.",
+    ],
+    [
+        /token has expired/i,
+        "The access token has expired. Request a new token and retry.",
+    ],
+    [
+        /federated identity account not found/i,
+        "No identity account exists for this user. " +
+            "The platform must create a federated account via createFederatedAccount " +
+            "before the user can authenticate.",
+    ],
+    [
+        /account provisioning failed/i,
+        "SSO account provisioning failed. " +
+            "Ensure the IdentityProvider's userinfo_endpoint is configured and the " +
+            "access token includes the 'openid email profile' scopes.",
+    ],
+];
 const INFRA_NOISE_PATTERNS = [
     [/no healthy upstream/i, "The server is temporarily unavailable."],
     [/ECONNREFUSED/i, "Unable to connect to the server."],
@@ -132,6 +165,10 @@ function extractRawMessage(error) {
 function sanitizeMessage(message) {
     if (!message)
         return "";
+    for (const [pattern, replacement] of AUTH_ERROR_PATTERNS) {
+        if (pattern.test(message))
+            return replacement;
+    }
     for (const [pattern, replacement] of INFRA_NOISE_PATTERNS) {
         if (pattern.test(message))
             return replacement;

package/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAkB,MAAM,cAAc,CAAC;AAE5D,kCAAkC;AAClC,OAAO,EACL,YAAY,EAEZ,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,GACZ,MAAM,cAAc,CAAC;AAyBtB,MAAM,wBAAwB,GAAkC;IAC9D,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM;IAC9B,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,YAAY;IACrC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW;IAC5B,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,YAAY;IACpC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,YAAY;IACvC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY;IAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,YAAY;IAClC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,YAAY;IAC5B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ;IACzB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ;IACxB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ;IACzB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,QAAQ;IAC9B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa;IACjC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,aAAa;IACtC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,aAAa;IACvC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW;CAC7B,CAAC;AAEF,MAAM,sBAAsB,GAAqC;IAC/D,eAAe,EAAE,MAAM;IACvB,mBAAmB,EAAE,YAAY;IACjC,WAAW,EAAE,WAAW;IACxB,kBAAkB,EAAE,YAAY;IAChC,gBAAgB,EAAE,YAAY;IAC9B,qBAAqB,EAAE,YAAY;IACnC,oBAAoB,EAAE,aAAa;IACnC,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,QAAQ;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,YAAY,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACzD,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,oBAAoB,GAA+B,IAAI,GAAG,CAAC;IAC/D,QAAQ;IACR,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,kBAAkB,GAAkC;IACxD,IAAI,EAAE,iDAAiD;IACvD,UAAU,EAAE,oDAAoD;IAChE,WAAW,EAAE,uCAAuC;IACpD,UAAU,EAAE,oCAAoC;IAChD,MAAM,EAAE,wDAAwD;IAChE,WAAW,EACT,sEAAsE;IACxE,SAAS,EAAE,4BAA4B;IACvC,OAAO,EAAE,+BAA+B;CACzC,CAAC;AAEF,MAAM,oBAAoB,GAA6C;IACrE,CAAC,sBAAsB,EAAE,wCAAwC,CAAC;IAClE,CAAC,eAAe,EAAE,kCAAkC,CAAC;IACrD,CAAC,aAAa,EAAE,wCAAwC,CAAC;IACzD,CAAC,YAAY,EAAE,0CAA0C,CAAC;IAC1D,CAAC,eAAe,EAAE,oDAAoD,CAAC;IACvE,CAAC,gBAAgB,EAAE,kDAAkD,CAAC;IACtE,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;IAC1E,CAAC,gBAAgB,EAAE,wCAAwC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,QAAiB;IAC9D,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,WAAW,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAA4B,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,QAA0B;IAE1B,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAkB,MAAM,cAAc,CAAC;AAE5D,kCAAkC;AAClC,OAAO,EACL,YAAY,EAEZ,SAAS,EACT,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,GACZ,MAAM,cAAc,CAAC;AAyBtB,MAAM,wBAAwB,GAAkC;IAC9D,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM;IAC9B,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,YAAY;IACrC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW;IAC5B,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,YAAY;IACpC,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,YAAY;IACvC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY;IAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,YAAY;IAClC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,YAAY;IAC5B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ;IACzB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ;IACxB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ;IACzB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,QAAQ;IAC9B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa;IACjC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,aAAa;IACtC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,aAAa;IACvC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,WAAW;CAC7B,CAAC;AAEF,MAAM,sBAAsB,GAAqC;IAC/D,eAAe,EAAE,MAAM;IACvB,mBAAmB,EAAE,YAAY;IACjC,WAAW,EAAE,WAAW;IACxB,kBAAkB,EAAE,YAAY;IAChC,gBAAgB,EAAE,YAAY;IAC9B,qBAAqB,EAAE,YAAY;IACnC,oBAAoB,EAAE,aAAa;IACnC,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,QAAQ;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,YAAY,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACzD,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,oBAAoB,GAA+B,IAAI,GAAG,CAAC;IAC/D,QAAQ;IACR,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,kBAAkB,GAAkC;IACxD,IAAI,EAAE,iDAAiD;IACvD,UAAU,EAAE,oDAAoD;IAChE,WAAW,EAAE,uCAAuC;IACpD,UAAU,EAAE,oCAAoC;IAChD,MAAM,EAAE,wDAAwD;IAChE,WAAW,EACT,sEAAsE;IACxE,SAAS,EAAE,4BAA4B;IACvC,OAAO,EAAE,+BAA+B;CACzC,CAAC;AAEF;;;;GAIG;AACH,MAAM,mBAAmB,GAA6C;IACpE;QACE,gCAAgC;QAChC,gFAAgF;YAC9E,uFAAuF;KAC1F;IACD;QACE,sCAAsC;QACtC,uCAAuC;YACrC,iFAAiF;KACpF;IACD;QACE,oBAAoB;QACpB,8DAA8D;KAC/D;IACD;QACE,uCAAuC;QACvC,4CAA4C;YAC1C,0EAA0E;YAC1E,mCAAmC;KACtC;IACD;QACE,8BAA8B;QAC9B,mCAAmC;YACjC,wEAAwE;YACxE,0DAA0D;KAC7D;CACF,CAAC;AAEF,MAAM,oBAAoB,GAA6C;IACrE,CAAC,sBAAsB,EAAE,wCAAwC,CAAC;IAClE,CAAC,eAAe,EAAE,kCAAkC,CAAC;IACrD,CAAC,aAAa,EAAE,wCAAwC,CAAC;IACzD,CAAC,YAAY,EAAE,0CAA0C,CAAC;IAC1D,CAAC,eAAe,EAAE,oDAAoD,CAAC;IACvE,CAAC,gBAAgB,EAAE,kDAAkD,CAAC;IACtE,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;IAC1E,CAAC,gBAAgB,EAAE,wCAAwC,CAAC;CAC7D,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,QAAiB;IAC9D,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,WAAW,CAAC;IAChD,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,WAAW,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAA4B,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAa,EACb,QAA0B;IAE1B,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/gen/identityprovider.d.ts

@@ -2,6 +2,7 @@ import { type DeleteResourceInput, type ResourceRef } from "./types";
 import { type Transport } from "@connectrpc/connect";
 import { type IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
 import { type ListIdentityProvidersByOrgInput, type IdentityProviders, type OrganizationSsoLookup, type SsoProviderInfo } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/io_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 /** Provides operations on identityprovider resources. */
 export declare class IdentityProviderClient {
     private readonly command;
@@ -30,5 +31,9 @@ export interface IdentityProviderInput {
     userinfoEndpoint?: string;
     isSsoProvider?: boolean;
     oidcClientId?: string;
+    autoProvisionAccounts?: boolean;
+    autoGrantOnOrg?: boolean;
+    autoGrantRole?: IamRole;
+    tenantOrgClaim?: string;
 }
 //# sourceMappingURL=identityprovider.d.ts.map

package/gen/identityprovider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identityprovider.d.ts","sourceRoot":"","sources":["../../src/gen/identityprovider.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAErE,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIhF,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAE1H,OAAO,EAAsH,KAAK,+BAA+B,EAAE,KAAK,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,KAAK,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAI9S,yDAAyD;AACzD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmD;IAC3E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiD;gBAE3D,SAAS,EAAE,SAAS;IAK1B,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM9D,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM/D,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM/D,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU7D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM1C,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM3D,SAAS,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAM7E,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;CAK7E;AAED,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}
+{"version":3,"file":"identityprovider.d.ts","sourceRoot":"","sources":["../../src/gen/identityprovider.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAErE,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIhF,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,2DAA2D,CAAC;AAE1H,OAAO,EAAsH,KAAK,+BAA+B,EAAE,KAAK,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,KAAK,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAG9S,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAEpE,yDAAyD;AACzD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmD;IAC3E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiD;gBAE3D,SAAS,EAAE,SAAS;IAK1B,KAAK,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM9D,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM/D,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM/D,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU7D,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM1C,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM3D,SAAS,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAM7E,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;CAK7E;AAED,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/gen/identityprovider.js

@@ -106,6 +106,10 @@ function buildIdentityProviderProto(input) {
             userinfoEndpoint: input.userinfoEndpoint,
             isSsoProvider: input.isSsoProvider,
             oidcClientId: input.oidcClientId,
+            autoProvisionAccounts: input.autoProvisionAccounts,
+            autoGrantOnOrg: input.autoGrantOnOrg,
+            autoGrantRole: input.autoGrantRole,
+            tenantOrgClaim: input.tenantOrgClaim,
         })),
     });
 }

package/gen/identityprovider.js.map

@@ -1 +1 @@
-{"version":3,"file":"identityprovider.js","sourceRoot":"","sources":["../../src/gen/identityprovider.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAA+B,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACrJ,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAyB,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,iCAAiC,EAAE,MAAM,+DAA+D,CAAC;AAElH,OAAO,EAAE,+BAA+B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AAExG,yDAAyD;AACzD,MAAM,OAAO,sBAAsB;IAChB,OAAO,CAAmD;IAC1D,KAAK,CAAiD;IAEvE,YAAY,SAAoB;QAC9B,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA4B;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA0B;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE;gBACpE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAgB;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,0BAA0B,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAClI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAsC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA4B;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;CACF;AAkBD,SAAS,0BAA0B,CAAC,KAA4B;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE;QACnD,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE;YACzD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAC9C,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,cAAc,CAAC;YACrE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;KACJ,CAAqB,CAAC;AACzB,CAAC"}
+{"version":3,"file":"identityprovider.js","sourceRoot":"","sources":["../../src/gen/identityprovider.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAA+B,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,sDAAsD,CAAC;AACrJ,OAAO,EAAE,yBAAyB,EAAE,MAAM,4DAA4D,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAyB,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,iCAAiC,EAAE,MAAM,+DAA+D,CAAC;AAElH,OAAO,EAAE,+BAA+B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,EAAE,0BAA0B,EAAE,MAAM,4DAA4D,CAAC;AAGxG,yDAAyD;AACzD,MAAM,OAAO,sBAAsB;IAChB,OAAO,CAAmD;IAC1D,KAAK,CAAiD;IAEvE,YAAY,SAAoB;QAC9B,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA4B;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA0B;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE;gBACpE,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAgB;QACnC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,0BAA0B,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAClI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAsC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA4B;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACrC,CAAC;CACF;AAsBD,SAAS,0BAA0B,CAAC,KAA4B;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,EAAE;QACnD,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,EAAE;YACzD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAC9C,CAAC;QACF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,cAAc,CAAC;YACrE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;KACJ,CAAqB,CAAC;AACzB,CAAC"}

package/node.d.ts

@@ -0,0 +1,52 @@
+import type { Transport } from "@connectrpc/connect";
+import { Stigmer, type TokenProvider } from "./index";
+/**
+ * Configuration for creating a Node.js-compatible Stigmer client.
+ *
+ * Uses `@connectrpc/connect-node` for native HTTP/2 transport instead
+ * of the browser-oriented `@connectrpc/connect-web` that the default
+ * `Stigmer` constructor uses.
+ */
+export interface NodeClientConfig {
+    /** Stigmer API server URL (e.g., "https://api.stigmer.ai"). */
+    readonly baseUrl: string;
+    /** Static API key for authentication. */
+    readonly apiKey?: string;
+    /** Dynamic token provider for authentication. */
+    readonly getAccessToken?: TokenProvider;
+}
+/**
+ * Create a gRPC-web transport for Node.js using native HTTP/2.
+ *
+ * The interceptor chain matches the browser transport for consistent
+ * behavior across runtimes:
+ * 1. Auth — attaches `Authorization: Bearer <token>`
+ * 2. RPC metadata — annotates errors with method name and service path
+ * 3. Error strip — removes gRPC status-code prefixes from messages
+ *
+ * The browser-specific auth-redirect interceptor (`onUnauthenticated`)
+ * is intentionally omitted — Node.js consumers handle auth failures
+ * through error handling, not UI redirects.
+ */
+export declare function createNodeTransport(config: NodeClientConfig): Transport;
+/**
+ * Create a Stigmer client configured for Node.js environments.
+ *
+ * Uses `@connectrpc/connect-node` for native HTTP/2 transport with the
+ * full SDK interceptor chain (auth, RPC metadata, error stripping).
+ * Suitable for CLI tools, server-side scripts, and Ink terminal apps.
+ *
+ * @example
+ * ```typescript
+ * import { createNodeClient } from "@stigmer/sdk/node";
+ *
+ * const stigmer = createNodeClient({
+ *   baseUrl: "https://api.stigmer.ai",
+ *   apiKey: "sk_live_abc123",
+ * });
+ *
+ * const agent = await stigmer.agent.get("my-agent");
+ * ```
+ */
+export declare function createNodeClient(config: NodeClientConfig): Stigmer;
+//# sourceMappingURL=node.d.ts.map

package/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAOtD;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB,iDAAiD;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;CACzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,CAgBvE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CASlE"}

package/node.js

@@ -0,0 +1,60 @@
+import { createGrpcWebTransport } from "@connectrpc/connect-node";
+import { Stigmer } from "./index";
+import { createAuthInterceptor, rpcMetadataInterceptor, errorStripInterceptor, } from "./internal/interceptors";
+/**
+ * Create a gRPC-web transport for Node.js using native HTTP/2.
+ *
+ * The interceptor chain matches the browser transport for consistent
+ * behavior across runtimes:
+ * 1. Auth — attaches `Authorization: Bearer <token>`
+ * 2. RPC metadata — annotates errors with method name and service path
+ * 3. Error strip — removes gRPC status-code prefixes from messages
+ *
+ * The browser-specific auth-redirect interceptor (`onUnauthenticated`)
+ * is intentionally omitted — Node.js consumers handle auth failures
+ * through error handling, not UI redirects.
+ */
+export function createNodeTransport(config) {
+    const tokenProvider = config.apiKey
+        ? () => config.apiKey
+        : config.getAccessToken ?? (() => null);
+    const interceptors = [
+        createAuthInterceptor(tokenProvider),
+        rpcMetadataInterceptor,
+        errorStripInterceptor,
+    ];
+    return createGrpcWebTransport({
+        baseUrl: config.baseUrl,
+        httpVersion: "2",
+        interceptors,
+    });
+}
+/**
+ * Create a Stigmer client configured for Node.js environments.
+ *
+ * Uses `@connectrpc/connect-node` for native HTTP/2 transport with the
+ * full SDK interceptor chain (auth, RPC metadata, error stripping).
+ * Suitable for CLI tools, server-side scripts, and Ink terminal apps.
+ *
+ * @example
+ * ```typescript
+ * import { createNodeClient } from "@stigmer/sdk/node";
+ *
+ * const stigmer = createNodeClient({
+ *   baseUrl: "https://api.stigmer.ai",
+ *   apiKey: "sk_live_abc123",
+ * });
+ *
+ * const agent = await stigmer.agent.get("my-agent");
+ * ```
+ */
+export function createNodeClient(config) {
+    const transport = createNodeTransport(config);
+    return new Stigmer({
+        baseUrl: config.baseUrl,
+        apiKey: config.apiKey,
+        getAccessToken: config.getAccessToken,
+        customTransport: transport,
+    });
+}
+//# sourceMappingURL=node.js.map

package/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,OAAO,EAAE,OAAO,EAAsB,MAAM,SAAS,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAoBjC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAwB;IAC1D,MAAM,aAAa,GAAkB,MAAM,CAAC,MAAM;QAChD,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAO;QACtB,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAE1C,MAAM,YAAY,GAAkB;QAClC,qBAAqB,CAAC,aAAa,CAAC;QACpC,sBAAsB;QACtB,qBAAqB;KACtB,CAAC;IAEF,OAAO,sBAAsB,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,GAAG;QAChB,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAE9C,OAAO,IAAI,OAAO,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/sdk",
-  "version": "0.0.86",
+  "version": "0.0.88",
   "description": "Stigmer TypeScript SDK — typed API client for all Stigmer platform resources",
   "license": "Apache-2.0",
   "type": "module",
@@ -27,6 +27,10 @@
     ".": {
       "types": "./index.d.ts",
       "import": "./index.js"
+    },
+    "./node": {
+      "types": "./node.d.ts",
+      "import": "./node.js"
     }
   },
   "dependencies": {
@@ -35,6 +39,7 @@
   },
   "peerDependencies": {
     "@bufbuild/protobuf": "^2.0.0",
-    "@stigmer/protos": "0.0.86"
+    "@connectrpc/connect-node": "^2.0.0",
+    "@stigmer/protos": "0.0.88"
   }
 }

package/src/__tests__/node.test.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect } from "vitest";
+import { createNodeClient, createNodeTransport } from "../node";
+
+describe("createNodeTransport", () => {
+  it("creates a transport with an API key", () => {
+    const transport = createNodeTransport({
+      baseUrl: "https://api.stigmer.ai",
+      apiKey: "sk_test_123",
+    });
+    expect(transport).toBeDefined();
+  });
+
+  it("creates a transport with a token provider", () => {
+    const transport = createNodeTransport({
+      baseUrl: "https://api.stigmer.ai",
+      getAccessToken: () => "token_abc",
+    });
+    expect(transport).toBeDefined();
+  });
+
+  it("creates a transport without auth", () => {
+    const transport = createNodeTransport({
+      baseUrl: "https://api.stigmer.ai",
+    });
+    expect(transport).toBeDefined();
+  });
+});
+
+describe("createNodeClient", () => {
+  it("creates a Stigmer client with API key", () => {
+    const client = createNodeClient({
+      baseUrl: "https://api.stigmer.ai",
+      apiKey: "sk_test_123",
+    });
+    expect(client).toBeDefined();
+    expect(client.baseUrl).toBe("https://api.stigmer.ai");
+  });
+
+  it("creates a Stigmer client with token provider", () => {
+    const client = createNodeClient({
+      baseUrl: "https://api.stigmer.ai",
+      getAccessToken: () => "token_abc",
+    });
+    expect(client).toBeDefined();
+    expect(client.baseUrl).toBe("https://api.stigmer.ai");
+  });
+
+  it("exposes resource sub-clients", () => {
+    const client = createNodeClient({
+      baseUrl: "https://api.stigmer.ai",
+      apiKey: "sk_test_123",
+    });
+    expect(client.agent).toBeDefined();
+    expect(client.session).toBeDefined();
+    expect(client.agentExecution).toBeDefined();
+  });
+});

package/src/config.ts

@@ -1,3 +1,5 @@
+import type { Transport } from "@connectrpc/connect";
+
 /**
  * Token provider callback for dynamic authentication.
  * Called per-request, allowing token refresh and auth state changes.
@@ -8,9 +10,13 @@ export type TokenProvider = () => Promise<string | null> | string | null;
 /**
  * Configuration for the Stigmer SDK client.
  *
- * Exactly one of `apiKey` or `getAccessToken` must be provided:
- * - `apiKey`: Static API key for server-to-server usage.
- * - `getAccessToken`: Dynamic token provider for browser or rotating credentials.
+ * Authentication: exactly one of `apiKey` or `getAccessToken` must be
+ * provided (unless `customTransport` handles auth independently).
+ *
+ * Transport: by default the SDK creates a browser-oriented transport
+ * using `@connectrpc/connect-web`. Pass `customTransport` to use a
+ * pre-built transport — for example, `@connectrpc/connect-node` for
+ * server-side or CLI usage.
  */
 export interface StigmerConfig {
   /** Base URL of the Stigmer API server (e.g., "https://api.stigmer.ai"). */
@@ -34,9 +40,38 @@ export interface StigmerConfig {
    * - `"grpc-web"` (default): gRPC-Web binary protocol. Compact, battle-tested.
    * - `"connect"`: Connect protocol over HTTP/JSON. Easier to debug with standard HTTP tooling.
    *
-   * Both protocols are supported by the Stigmer server.
+   * Both protocols are supported by the Stigmer server. Ignored when
+   * `customTransport` is provided.
    */
   readonly transport?: "grpc-web" | "connect";
+
+  /**
+   * Pre-built ConnectRPC transport.
+   *
+   * When provided, the SDK uses this transport directly instead of
+   * creating one from `baseUrl`, `transport`, and the auth fields.
+   * This enables non-browser environments (Node.js CLIs, edge runtimes)
+   * to supply a transport with native HTTP/2 support via
+   * `@connectrpc/connect-node` or any other ConnectRPC transport.
+   *
+   * The caller is responsible for configuring auth interceptors on the
+   * custom transport; the SDK's built-in auth interceptor is bypassed.
+   *
+   * @example
+   * ```typescript
+   * import { createConnectTransport } from "@connectrpc/connect-node";
+   * import { Stigmer } from "@stigmer/sdk";
+   *
+   * const stigmer = new Stigmer({
+   *   baseUrl: "https://api.stigmer.ai",
+   *   customTransport: createConnectTransport({
+   *     baseUrl: "https://api.stigmer.ai",
+   *     httpVersion: "2",
+   *   }),
+   * });
+   * ```
+   */
+  readonly customTransport?: Transport;
 }
 
 /**
@@ -47,6 +82,12 @@ export function validateConfig(config: StigmerConfig): void {
     throw new Error("stigmer: baseUrl is required");
   }
 
+  // When a custom transport is supplied, auth fields are optional — the
+  // caller is responsible for wiring auth interceptors on the transport.
+  if (config.customTransport) {
+    return;
+  }
+
   const hasApiKey = typeof config.apiKey === "string" && config.apiKey.length > 0;
   const hasTokenProvider = typeof config.getAccessToken === "function";
 

package/src/errors.ts

@@ -124,6 +124,40 @@ const CATEGORY_FALLBACKS: Record<ErrorCategory, string> = {
   unknown: "An unexpected error occurred.",
 };
 
+/**
+ * Maps enriched auth error descriptions from the backend into developer-friendly
+ * guidance. These patterns match the actionable descriptions returned by the
+ * gRPC interceptor chain (GrpcSecurityConfigBase + GrpcRequestContextBuilderInterceptor).
+ */
+const AUTH_ERROR_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
+  [
+    /token audience does not match/i,
+    "The token's audience does not match the IdentityProvider's expected_audience. " +
+      "Verify your Auth0 API identifier matches the expected_audience configured in Stigmer.",
+  ],
+  [
+    /token signature verification failed/i,
+    "Token signature verification failed. " +
+      "Check that the IdentityProvider's jwks_uri points to the correct JWKS endpoint.",
+  ],
+  [
+    /token has expired/i,
+    "The access token has expired. Request a new token and retry.",
+  ],
+  [
+    /federated identity account not found/i,
+    "No identity account exists for this user. " +
+      "The platform must create a federated account via createFederatedAccount " +
+      "before the user can authenticate.",
+  ],
+  [
+    /account provisioning failed/i,
+    "SSO account provisioning failed. " +
+      "Ensure the IdentityProvider's userinfo_endpoint is configured and the " +
+      "access token includes the 'openid email profile' scopes.",
+  ],
+];
+
 const INFRA_NOISE_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [
   [/no healthy upstream/i, "The server is temporarily unavailable."],
   [/ECONNREFUSED/i, "Unable to connect to the server."],
@@ -175,6 +209,9 @@ function extractRawMessage(error: unknown): string {
 
 function sanitizeMessage(message: string): string {
   if (!message) return "";
+  for (const [pattern, replacement] of AUTH_ERROR_PATTERNS) {
+    if (pattern.test(message)) return replacement;
+  }
   for (const [pattern, replacement] of INFRA_NOISE_PATTERNS) {
     if (pattern.test(message)) return replacement;
   }

package/src/gen/identityprovider.ts

@@ -13,6 +13,7 @@ import { IdentityProviderCommandController } from "@stigmer/protos/ai/stigmer/ia
 import { ListIdentityProvidersByOrgInputSchema, IdentityProvidersSchema, OrganizationSsoLookupSchema, SsoProviderInfoSchema, type ListIdentityProvidersByOrgInput, type IdentityProviders, type OrganizationSsoLookup, type SsoProviderInfo } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/io_pb";
 import { IdentityProviderQueryController } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/query_pb";
 import { IdentityProviderSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/spec_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 /** Provides operations on identityprovider resources. */
 export class IdentityProviderClient {
@@ -91,6 +92,10 @@ export interface IdentityProviderInput {
   userinfoEndpoint?: string;
   isSsoProvider?: boolean;
   oidcClientId?: string;
+  autoProvisionAccounts?: boolean;
+  autoGrantOnOrg?: boolean;
+  autoGrantRole?: IamRole;
+  tenantOrgClaim?: string;
 }
 
 function buildIdentityProviderProto(input: IdentityProviderInput): IdentityProvider {
@@ -112,6 +117,10 @@ function buildIdentityProviderProto(input: IdentityProviderInput): IdentityProvi
       userinfoEndpoint: input.userinfoEndpoint,
       isSsoProvider: input.isSsoProvider,
       oidcClientId: input.oidcClientId,
+      autoProvisionAccounts: input.autoProvisionAccounts,
+      autoGrantOnOrg: input.autoGrantOnOrg,
+      autoGrantRole: input.autoGrantRole,
+      tenantOrgClaim: input.tenantOrgClaim,
     })),
   }) as IdentityProvider;
 }

package/src/node.ts

@@ -0,0 +1,87 @@
+import { createGrpcWebTransport } from "@connectrpc/connect-node";
+import type { Transport, Interceptor } from "@connectrpc/connect";
+import { Stigmer, type TokenProvider } from "./index";
+import {
+  createAuthInterceptor,
+  rpcMetadataInterceptor,
+  errorStripInterceptor,
+} from "./internal/interceptors";
+
+/**
+ * Configuration for creating a Node.js-compatible Stigmer client.
+ *
+ * Uses `@connectrpc/connect-node` for native HTTP/2 transport instead
+ * of the browser-oriented `@connectrpc/connect-web` that the default
+ * `Stigmer` constructor uses.
+ */
+export interface NodeClientConfig {
+  /** Stigmer API server URL (e.g., "https://api.stigmer.ai"). */
+  readonly baseUrl: string;
+
+  /** Static API key for authentication. */
+  readonly apiKey?: string;
+
+  /** Dynamic token provider for authentication. */
+  readonly getAccessToken?: TokenProvider;
+}
+
+/**
+ * Create a gRPC-web transport for Node.js using native HTTP/2.
+ *
+ * The interceptor chain matches the browser transport for consistent
+ * behavior across runtimes:
+ * 1. Auth — attaches `Authorization: Bearer <token>`
+ * 2. RPC metadata — annotates errors with method name and service path
+ * 3. Error strip — removes gRPC status-code prefixes from messages
+ *
+ * The browser-specific auth-redirect interceptor (`onUnauthenticated`)
+ * is intentionally omitted — Node.js consumers handle auth failures
+ * through error handling, not UI redirects.
+ */
+export function createNodeTransport(config: NodeClientConfig): Transport {
+  const tokenProvider: TokenProvider = config.apiKey
+    ? () => config.apiKey!
+    : config.getAccessToken ?? (() => null);
+
+  const interceptors: Interceptor[] = [
+    createAuthInterceptor(tokenProvider),
+    rpcMetadataInterceptor,
+    errorStripInterceptor,
+  ];
+
+  return createGrpcWebTransport({
+    baseUrl: config.baseUrl,
+    httpVersion: "2",
+    interceptors,
+  });
+}
+
+/**
+ * Create a Stigmer client configured for Node.js environments.
+ *
+ * Uses `@connectrpc/connect-node` for native HTTP/2 transport with the
+ * full SDK interceptor chain (auth, RPC metadata, error stripping).
+ * Suitable for CLI tools, server-side scripts, and Ink terminal apps.
+ *
+ * @example
+ * ```typescript
+ * import { createNodeClient } from "@stigmer/sdk/node";
+ *
+ * const stigmer = createNodeClient({
+ *   baseUrl: "https://api.stigmer.ai",
+ *   apiKey: "sk_live_abc123",
+ * });
+ *
+ * const agent = await stigmer.agent.get("my-agent");
+ * ```
+ */
+export function createNodeClient(config: NodeClientConfig): Stigmer {
+  const transport = createNodeTransport(config);
+
+  return new Stigmer({
+    baseUrl: config.baseUrl,
+    apiKey: config.apiKey,
+    getAccessToken: config.getAccessToken,
+    customTransport: transport,
+  });
+}

package/src/stigmer.ts

@@ -49,13 +49,13 @@ export class Stigmer extends GeneratedClient {
   constructor(config: StigmerConfig) {
     validateConfig(config);
 
-    const transport = createStigmerTransport(config);
+    const transport = config.customTransport ?? createStigmerTransport(config);
     super(transport);
 
     this.baseUrl = config.baseUrl;
     this._tokenProvider = config.apiKey
       ? () => config.apiKey!
-      : config.getAccessToken!;
+      : config.getAccessToken ?? (() => null);
 
     this.search = new SearchClient(transport);
     this.github = new GitHubClient(transport);

package/stigmer.js

@@ -40,12 +40,12 @@ export class Stigmer extends GeneratedClient {
     _tokenProvider;
     constructor(config) {
         validateConfig(config);
-        const transport = createStigmerTransport(config);
+        const transport = config.customTransport ?? createStigmerTransport(config);
         super(transport);
         this.baseUrl = config.baseUrl;
         this._tokenProvider = config.apiKey
             ? () => config.apiKey
-            : config.getAccessToken;
+            : config.getAccessToken ?? (() => null);
         this.search = new SearchClient(transport);
         this.github = new GitHubClient(transport);
     }

package/stigmer.js.map

@@ -1 +1 @@
-{"version":3,"file":"stigmer.js","sourceRoot":"","sources":["../src/stigmer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,cAAc,GAGf,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,OAAQ,SAAQ,eAAe;IAC1C;;;;;;OAMG;IACM,OAAO,CAAS;IAEhB,MAAM,CAAe;IACrB,MAAM,CAAe;IAEb,cAAc,CAAgB;IAE/C,YAAY,MAAqB;QAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;QAEvB,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,CAAC,SAAS,CAAC,CAAC;QAEjB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM;YACjC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAO;YACtB,CAAC,CAAC,MAAM,CAAC,cAAe,CAAC;QAE3B,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB;QACrB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;CACF"}
+{"version":3,"file":"stigmer.js","sourceRoot":"","sources":["../src/stigmer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,cAAc,GAGf,MAAM,UAAU,CAAC;AAElB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,OAAQ,SAAQ,eAAe;IAC1C;;;;;;OAMG;IACM,OAAO,CAAS;IAEhB,MAAM,CAAe;IACrB,MAAM,CAAe;IAEb,cAAc,CAAgB;IAE/C,YAAY,MAAqB;QAC/B,cAAc,CAAC,MAAM,CAAC,CAAC;QAEvB,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC3E,KAAK,CAAC,SAAS,CAAC,CAAC;QAEjB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM;YACjC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAO;YACtB,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,iBAAiB;QACrB,OAAO,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC;CACF"}