@stigmer/sdk 3.1.7 → 3.1.8

package/src/__tests__/guest-auth.test.ts

@@ -0,0 +1,287 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { MintGuestTokenResponseSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
+import { ConnectError, Code } from "@connectrpc/connect";
+
+// Intercept the token client so no transport is exercised. The mock
+// preserves the real module (create/Code/ConnectError) and only stubs
+// createClient, which GuestAuth uses to build its RPC client.
+const mintGuestToken = vi.fn();
+vi.mock("@connectrpc/connect", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@connectrpc/connect")>();
+  return {
+    ...actual,
+    createClient: () => ({ mintGuestToken }),
+  };
+});
+
+import { createGuestAuth, GuestAuth, type GuestIdStorage } from "../guest-auth";
+
+const CONFIG = {
+  baseUrl: "https://api.stigmer.ai",
+  org: "acme",
+  slug: "support-agent",
+};
+
+function createMemoryStorage(): GuestIdStorage & { store: Map<string, string> } {
+  const store = new Map<string, string>();
+  return {
+    store,
+    getItem: (key) => store.get(key) ?? null,
+    setItem: (key, value) => {
+      store.set(key, value);
+    },
+  };
+}
+
+function mintResponse(overrides?: {
+  accessToken?: string;
+  expiresIn?: number;
+  guestCookieId?: string;
+}) {
+  return create(MintGuestTokenResponseSchema, {
+    accessToken: overrides?.accessToken ?? "guest-jwt-1",
+    tokenType: "Bearer",
+    expiresIn: overrides?.expiresIn ?? 900,
+    guestCookieId: overrides?.guestCookieId ?? "cookie-abc",
+  });
+}
+
+beforeEach(() => {
+  mintGuestToken.mockReset();
+  vi.useFakeTimers();
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe("createGuestAuth", () => {
+  it("throws when baseUrl is missing", () => {
+    expect(() =>
+      createGuestAuth({ ...CONFIG, baseUrl: "" }),
+    ).toThrow("baseUrl is required");
+  });
+
+  it("throws when org is missing", () => {
+    expect(() => createGuestAuth({ ...CONFIG, org: "" })).toThrow(
+      "org is required",
+    );
+  });
+
+  it("throws when slug is missing", () => {
+    expect(() => createGuestAuth({ ...CONFIG, slug: "" })).toThrow(
+      "slug is required",
+    );
+  });
+
+  it("returns a GuestAuth instance with valid config", () => {
+    expect(createGuestAuth(CONFIG)).toBeInstanceOf(GuestAuth);
+  });
+});
+
+describe("GuestAuth.getAccessToken", () => {
+  it("mints on first call and sends an empty guest id", async () => {
+    mintGuestToken.mockResolvedValue(mintResponse());
+    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
+
+    const token = await auth.getAccessToken();
+
+    expect(token).toBe("guest-jwt-1");
+    expect(mintGuestToken).toHaveBeenCalledTimes(1);
+    expect(mintGuestToken.mock.calls[0][0]).toMatchObject({
+      org: "acme",
+      slug: "support-agent",
+      guestCookieId: "",
+      // No embedOrigin configured (the unframed hosted page): the field
+      // must stay empty so the server's absence-means-exempt rule applies.
+      embedOrigin: "",
+    });
+  });
+
+  it("passes the configured embedOrigin through to every mint", async () => {
+    mintGuestToken.mockResolvedValue(mintResponse());
+    const auth = createGuestAuth({
+      ...CONFIG,
+      storage: createMemoryStorage(),
+      embedOrigin: "https://docs.example.com",
+    });
+
+    await auth.getAccessToken();
+    // Expire the cached token, forcing a re-mint — the origin must persist.
+    vi.advanceTimersByTime(900_000);
+    await auth.getAccessToken();
+
+    expect(mintGuestToken).toHaveBeenCalledTimes(2);
+    for (const call of mintGuestToken.mock.calls) {
+      expect(call[0]).toMatchObject({ embedOrigin: "https://docs.example.com" });
+    }
+  });
+
+  it("passes the configured linkToken through to every mint", async () => {
+    mintGuestToken.mockResolvedValue(mintResponse());
+    const auth = createGuestAuth({
+      ...CONFIG,
+      storage: createMemoryStorage(),
+      linkToken: "tok123",
+    });
+
+    await auth.getAccessToken();
+    // Expire the cached token, forcing a re-mint — the token must persist
+    // so a locked link keeps working across silent re-mints.
+    vi.advanceTimersByTime(900_000);
+    await auth.getAccessToken();
+
+    expect(mintGuestToken).toHaveBeenCalledTimes(2);
+    for (const call of mintGuestToken.mock.calls) {
+      expect(call[0]).toMatchObject({ linkToken: "tok123" });
+    }
+  });
+
+  it("sends an empty linkToken when none is configured (plain link)", async () => {
+    mintGuestToken.mockResolvedValue(mintResponse());
+    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
+
+    await auth.getAccessToken();
+
+    expect(mintGuestToken.mock.calls[0][0]).toMatchObject({ linkToken: "" });
+  });
+
+  it("rejects with permission-denied when the embed origin is refused", async () => {
+    mintGuestToken.mockRejectedValue(
+      new ConnectError(
+        "This agent can\u2019t be embedded on this site.",
+        Code.PermissionDenied,
+      ),
+    );
+    const auth = createGuestAuth({
+      ...CONFIG,
+      storage: createMemoryStorage(),
+      embedOrigin: "https://evil.example.com",
+    });
+
+    await expect(auth.getAccessToken()).rejects.toMatchObject({
+      code: "permission-denied",
+    });
+  });
+
+  it("persists the server-issued guest id and presents it on re-mint", async () => {
+    const storage = createMemoryStorage();
+    mintGuestToken.mockResolvedValue(mintResponse({ guestCookieId: "cookie-abc" }));
+    const auth = createGuestAuth({ ...CONFIG, storage });
+
+    await auth.getAccessToken();
+    expect(storage.store.get("stigmer:guest-id:acme")).toBe("cookie-abc");
+    expect(auth.guestCookieId).toBe("cookie-abc");
+
+    // Expire the cached token, forcing a second mint.
+    vi.advanceTimersByTime(900_000);
+    await auth.getAccessToken();
+
+    expect(mintGuestToken).toHaveBeenCalledTimes(2);
+    expect(mintGuestToken.mock.calls[1][0]).toMatchObject({
+      guestCookieId: "cookie-abc",
+    });
+  });
+
+  it("restores a persisted guest id from a prior visit", async () => {
+    const storage = createMemoryStorage();
+    storage.setItem("stigmer:guest-id:acme", "cookie-from-last-visit");
+    mintGuestToken.mockResolvedValue(mintResponse());
+    const auth = createGuestAuth({ ...CONFIG, storage });
+
+    await auth.getAccessToken();
+
+    expect(mintGuestToken.mock.calls[0][0]).toMatchObject({
+      guestCookieId: "cookie-from-last-visit",
+    });
+  });
+
+  it("returns the cached token while it is fresh", async () => {
+    mintGuestToken.mockResolvedValue(mintResponse());
+    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
+
+    await auth.getAccessToken();
+    // 13 minutes into a 15-minute token: still beyond the 60s skew.
+    vi.advanceTimersByTime(13 * 60_000);
+    const token = await auth.getAccessToken();
+
+    expect(token).toBe("guest-jwt-1");
+    expect(mintGuestToken).toHaveBeenCalledTimes(1);
+  });
+
+  it("re-mints when the cached token is within the expiry skew", async () => {
+    mintGuestToken
+      .mockResolvedValueOnce(mintResponse({ accessToken: "guest-jwt-1" }))
+      .mockResolvedValueOnce(mintResponse({ accessToken: "guest-jwt-2" }));
+    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
+
+    await auth.getAccessToken();
+    // 30 seconds of life left — inside the 60s skew window.
+    vi.advanceTimersByTime(900_000 - 30_000);
+    const token = await auth.getAccessToken();
+
+    expect(token).toBe("guest-jwt-2");
+    expect(mintGuestToken).toHaveBeenCalledTimes(2);
+  });
+
+  it("collapses concurrent callers into a single mint", async () => {
+    let release!: (value: ReturnType<typeof mintResponse>) => void;
+    mintGuestToken.mockImplementation(
+      () => new Promise((resolve) => { release = resolve; }),
+    );
+    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
+
+    const first = auth.getAccessToken();
+    const second = auth.getAccessToken();
+    release(mintResponse());
+
+    await expect(first).resolves.toBe("guest-jwt-1");
+    await expect(second).resolves.toBe("guest-jwt-1");
+    expect(mintGuestToken).toHaveBeenCalledTimes(1);
+  });
+
+  it("rejects with a wrapped StigmerError when sharing is revoked", async () => {
+    mintGuestToken.mockRejectedValue(
+      new ConnectError("agent not found", Code.NotFound),
+    );
+    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
+
+    try {
+      await auth.getAccessToken();
+      expect.fail("should have thrown");
+    } catch (e: unknown) {
+      expect(e).toHaveProperty("name", "StigmerError");
+      expect(e).toHaveProperty("code", "not-found");
+    }
+  });
+
+  it("recovers after a failed mint instead of caching the failure", async () => {
+    mintGuestToken
+      .mockRejectedValueOnce(new ConnectError("unavailable", Code.Unavailable))
+      .mockResolvedValueOnce(mintResponse());
+    const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
+
+    await expect(auth.getAccessToken()).rejects.toMatchObject({
+      code: "unavailable",
+    });
+    await expect(auth.getAccessToken()).resolves.toBe("guest-jwt-1");
+    expect(mintGuestToken).toHaveBeenCalledTimes(2);
+  });
+
+  it("still mints when storage throws", async () => {
+    const brokenStorage: GuestIdStorage = {
+      getItem: () => {
+        throw new Error("storage disabled");
+      },
+      setItem: () => {
+        throw new Error("storage disabled");
+      },
+    };
+    mintGuestToken.mockResolvedValue(mintResponse());
+    const auth = createGuestAuth({ ...CONFIG, storage: brokenStorage });
+
+    await expect(auth.getAccessToken()).resolves.toBe("guest-jwt-1");
+    expect(auth.guestCookieId).toBeNull();
+  });
+});

package/src/__tests__/sharing.test.ts

@@ -0,0 +1,159 @@
+// Unit tests for the framework-free agent-sharing helpers: origin
+// validation (mirror of the proto CEL rule) and the hosted-link / embed
+// snippet builders shared by the web console, desktop app, and CLI.
+
+import { describe, expect, it } from "vitest";
+import {
+  LINK_TOKEN_PARAM,
+  MAX_ALLOWED_ORIGINS,
+  appendLinkToken,
+  buildChatUrl,
+  buildEmbedLoaderUrl,
+  buildEmbedSnippet,
+  chatPath,
+  validateOrigin,
+} from "../sharing";
+
+describe("validateOrigin", () => {
+  it("accepts exact web origins", () => {
+    expect(validateOrigin("https://example.com")).toBeNull();
+    expect(validateOrigin("http://example.com")).toBeNull();
+    expect(validateOrigin("https://sub.example.com")).toBeNull();
+    expect(validateOrigin("https://example.com:8443")).toBeNull();
+    expect(validateOrigin("http://localhost:3000")).toBeNull();
+  });
+
+  it("trims surrounding whitespace before validating", () => {
+    expect(validateOrigin("  https://example.com  ")).toBeNull();
+  });
+
+  it("rejects empty input with guidance", () => {
+    expect(validateOrigin("")).toMatch(/Enter an origin/);
+    expect(validateOrigin("   ")).toMatch(/Enter an origin/);
+  });
+
+  it("rejects trailing slashes, paths, queries, and fragments", () => {
+    for (const bad of [
+      "https://example.com/",
+      "https://example.com/path",
+      "https://example.com?q=1",
+      "https://example.com#top",
+    ]) {
+      expect(validateOrigin(bad)).toMatch(/exact web origin/);
+    }
+  });
+
+  it("rejects non-http(s) schemes and bare hosts", () => {
+    expect(validateOrigin("ftp://example.com")).toMatch(/exact web origin/);
+    expect(validateOrigin("example.com")).toMatch(/exact web origin/);
+  });
+
+  it("rejects hostname labels with leading/trailing hyphens", () => {
+    expect(validateOrigin("https://-bad.example.com")).toMatch(/exact web origin/);
+    expect(validateOrigin("https://bad-.example.com")).toMatch(/exact web origin/);
+  });
+
+  it("exposes the proto max_items bound", () => {
+    expect(MAX_ALLOWED_ORIGINS).toBe(32);
+  });
+});
+
+describe("chatPath / buildChatUrl", () => {
+  it("builds the canonical /chat/<org>/<slug> path", () => {
+    expect(chatPath("acme", "support-agent")).toBe("/chat/acme/support-agent");
+  });
+
+  it("builds the absolute hosted chat URL", () => {
+    expect(buildChatUrl("https://app.stigmer.ai", "acme", "support-agent")).toBe(
+      "https://app.stigmer.ai/chat/acme/support-agent",
+    );
+  });
+
+  it("tolerates a trailing slash on the origin", () => {
+    expect(buildChatUrl("https://app.stigmer.ai/", "acme", "support-agent")).toBe(
+      "https://app.stigmer.ai/chat/acme/support-agent",
+    );
+  });
+
+  it("works with localhost origins (local backend)", () => {
+    expect(buildChatUrl("http://localhost:8234", "stigmer", "helper")).toBe(
+      "http://localhost:8234/chat/stigmer/helper",
+    );
+  });
+
+  it("appends ?k= when the share link is locked with a token", () => {
+    expect(chatPath("acme", "support-agent", "tok123")).toBe(
+      "/chat/acme/support-agent?k=tok123",
+    );
+    expect(
+      buildChatUrl("https://app.stigmer.ai", "acme", "support-agent", "tok123"),
+    ).toBe("https://app.stigmer.ai/chat/acme/support-agent?k=tok123");
+  });
+
+  it("url-encodes the token (defense in depth; generated tokens are url-safe)", () => {
+    expect(chatPath("acme", "bot", "a+b/c")).toBe("/chat/acme/bot?k=a%2Bb%2Fc");
+  });
+
+  it("omits ?k= for an empty/undefined token (plain link)", () => {
+    expect(chatPath("acme", "bot", "")).toBe("/chat/acme/bot");
+    expect(chatPath("acme", "bot", undefined)).toBe("/chat/acme/bot");
+  });
+});
+
+describe("appendLinkToken", () => {
+  it("appends the identical ?k= shape chatPath emits", () => {
+    expect(appendLinkToken("https://app.stigmer.ai/chat/acme/bot", "tok123")).toBe(
+      buildChatUrl("https://app.stigmer.ai", "acme", "bot", "tok123"),
+    );
+  });
+
+  it("uses & when the URL already carries a query", () => {
+    expect(appendLinkToken("/chat/acme/bot?theme=dark", "tok123")).toBe(
+      `/chat/acme/bot?theme=dark&${LINK_TOKEN_PARAM}=tok123`,
+    );
+  });
+
+  it("returns the URL unchanged for a null/empty token", () => {
+    expect(appendLinkToken("/chat/acme/bot", null)).toBe("/chat/acme/bot");
+    expect(appendLinkToken("/chat/acme/bot", undefined)).toBe("/chat/acme/bot");
+    expect(appendLinkToken("/chat/acme/bot", "")).toBe("/chat/acme/bot");
+  });
+});
+
+describe("buildEmbedLoaderUrl", () => {
+  it("points at embed.js on the app origin root", () => {
+    expect(buildEmbedLoaderUrl("https://app.stigmer.ai")).toBe("https://app.stigmer.ai/embed.js");
+  });
+
+  it("tolerates a trailing slash on the origin", () => {
+    expect(buildEmbedLoaderUrl("https://app.stigmer.ai/")).toBe("https://app.stigmer.ai/embed.js");
+  });
+});
+
+describe("buildEmbedSnippet", () => {
+  it("emits exactly the two-line loader + element snippet", () => {
+    expect(buildEmbedSnippet("https://app.stigmer.ai", "acme", "support-agent")).toBe(
+      [
+        `<script src="https://app.stigmer.ai/embed.js" async></script>`,
+        `<stigmer-agent org="acme" agent="support-agent"></stigmer-agent>`,
+      ].join("\n"),
+    );
+  });
+
+  it("adds the token attribute when the share link is locked", () => {
+    expect(
+      buildEmbedSnippet("https://app.stigmer.ai", "acme", "support-agent", "tok123"),
+    ).toBe(
+      [
+        `<script src="https://app.stigmer.ai/embed.js" async></script>`,
+        `<stigmer-agent org="acme" agent="support-agent" token="tok123"></stigmer-agent>`,
+      ].join("\n"),
+    );
+  });
+
+  it("omits the token attribute for an empty token (plain link)", () => {
+    expect(buildEmbedSnippet("https://app.stigmer.ai", "acme", "bot", "")).toBe(
+      buildEmbedSnippet("https://app.stigmer.ai", "acme", "bot"),
+    );
+  });
+});

package/src/gen/agent.ts

@@ -7,9 +7,9 @@ import { create } from "@bufbuild/protobuf";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
 import { AgentSchema, type Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
-import { AgentIdSchema, GetDefaultAgentRequestSchema, type GetDefaultAgentRequest } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/io_pb";
+import { AgentIdSchema, UpdateAgentSharingInputSchema, RotateShareLinkInputSchema, GetDefaultAgentRequestSchema, GetSharedProfileRequestSchema, SharedAgentProfileSchema, type UpdateAgentSharingInput, type RotateShareLinkInput, type GetDefaultAgentRequest, type GetSharedProfileRequest, type SharedAgentProfile } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/io_pb";
 import { AgentQueryController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/query_pb";
-import { AgentSpecSchema, ToolApprovalOverrideSchema, McpServerUsageSchema, McpAccessSchema, SubAgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import { AgentSpecSchema, AgentSharingAudience, ToolApprovalOverrideSchema, McpServerUsageSchema, McpAccessSchema, SubAgentSchema, AgentSharingMessagesSchema, AgentSharingSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import { EnvVarDeclarationSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
@@ -55,6 +55,18 @@ export class AgentClient {
     } catch (e) { throw wrapError(e); }
   }
 
+  async updateSharing(input: UpdateAgentSharingInput): Promise<Agent> {
+    try {
+      return await this.command.updateSharing(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async rotateShareLink(input: RotateShareLinkInput): Promise<Agent> {
+    try {
+      return await this.command.rotateShareLink(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
   async delete(id: string): Promise<Agent> {
     try {
       return await this.command.delete(create(AgentIdSchema, { value: id }));
@@ -79,6 +91,18 @@ export class AgentClient {
     } catch (e) { throw wrapError(e); }
   }
 
+  async getSharedProfile(input: GetSharedProfileRequest): Promise<SharedAgentProfile> {
+    try {
+      return await this.query.getSharedProfile(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
+  async getSharedProfileForMember(ref: ResourceRef): Promise<SharedAgentProfile> {
+    try {
+      return await this.query.getSharedProfileForMember(create(ApiResourceReferenceSchema, { ...ref, kind: ApiResourceKind.agent }));
+    } catch (e) { throw wrapError(e); }
+  }
+
   async list(params: ListParams): Promise<ListResult> {
     try {
       const resp = await this.search.search(create(SearchRequestSchema, {
@@ -112,6 +136,7 @@ export interface AgentInput {
   skillRefs?: ResourceRef[];
   subAgents?: SubAgentInput[];
   env?: Record<string, EnvVarDeclarationInput>;
+  sharing?: AgentSharingInput;
 }
 
 /** SDK input type for McpServerUsage. */
@@ -151,6 +176,21 @@ export interface EnvVarDeclarationInput {
   optional?: boolean;
 }
 
+/** SDK input type for AgentSharing. */
+export interface AgentSharingInput {
+  enabled?: boolean;
+  allowedOrigins?: string[];
+  messages?: AgentSharingMessagesInput;
+  audience?: AgentSharingAudience;
+}
+
+/** SDK input type for AgentSharingMessages. */
+export interface AgentSharingMessagesInput {
+  rateLimited?: string;
+  unavailable?: string;
+  conversationEnded?: string;
+}
+
 function buildToolApprovalOverrideProto(input: ToolApprovalOverrideInput) {
   return Object.assign(create(ToolApprovalOverrideSchema), stripUndefined({
     toolName: input.toolName,
@@ -193,6 +233,23 @@ function buildEnvVarDeclarationProto(input: EnvVarDeclarationInput) {
   }));
 }
 
+function buildAgentSharingMessagesProto(input: AgentSharingMessagesInput) {
+  return Object.assign(create(AgentSharingMessagesSchema), stripUndefined({
+    rateLimited: input.rateLimited,
+    unavailable: input.unavailable,
+    conversationEnded: input.conversationEnded,
+  }));
+}
+
+function buildAgentSharingProto(input: AgentSharingInput) {
+  const msg = create(AgentSharingSchema);
+  if (input.enabled !== undefined) msg.enabled = input.enabled;
+  if (input.allowedOrigins) msg.allowedOrigins = input.allowedOrigins;
+  if (input.messages) msg.messages = buildAgentSharingMessagesProto(input.messages);
+  if (input.audience !== undefined) msg.audience = input.audience;
+  return msg;
+}
+
 export function buildAgentProto(input: AgentInput): Agent {
   const mcpServerUsages = input.mcpServerUsages?.map(buildMcpServerUsageProto);
   const skillRefs = input.skillRefs?.map(r => create(ApiResourceReferenceSchema, { ...r, kind: 43 }));
@@ -201,6 +258,7 @@ export function buildAgentProto(input: AgentInput): Agent {
   if (input.env) {
     env = Object.fromEntries(Object.entries(input.env).map(([k, v]) => [k, buildEnvVarDeclarationProto(v)]));
   }
+  const sharing = input.sharing ? buildAgentSharingProto(input.sharing) : undefined;
   return Object.assign(create(AgentSchema), {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "Agent",
@@ -219,6 +277,7 @@ export function buildAgentProto(input: AgentInput): Agent {
       skillRefs,
       subAgents,
       env,
+      sharing,
     })),
   }) as Agent;
 }

package/src/gen/client.ts

@@ -74,7 +74,7 @@ export class GeneratedClient {
 
 // Re-export all resource client types and input types.
 export { AgentClient } from "./agent.js";
-export { type AgentInput, type McpServerUsageInput, type ToolApprovalOverrideInput, type SubAgentInput, type McpAccessInput, type EnvVarDeclarationInput } from "./agent.js";
+export { type AgentInput, type McpServerUsageInput, type ToolApprovalOverrideInput, type SubAgentInput, type McpAccessInput, type EnvVarDeclarationInput, type AgentSharingInput, type AgentSharingMessagesInput } from "./agent.js";
 export { AgentExecutionClient } from "./agentexecution.js";
 export { type AgentExecutionInput, type ExecutionConfigInput, type ContextManagementConfigInput, type AttachmentInput } from "./agentexecution.js";
 export { AgentInstanceClient } from "./agentinstance.js";

package/src/gen/environment.ts

@@ -12,7 +12,7 @@ import { EnvironmentQueryController } from "@stigmer/protos/ai/stigmer/agentic/e
 import { EnvironmentValueSchema, EnvironmentSpecSchema, type EnvironmentValue } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { ApiResourceIdSchema, ApiResourceReferenceSchema, ApiResourceDeleteInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import { ApiResourceIdSchema, ApiResourceReferenceSchema, ApiResourceDeleteInputSchema, type UpdateVisibilityInput } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 
 /** Provides operations on environment resources. */
@@ -43,6 +43,12 @@ export class EnvironmentClient {
     } catch (e) { throw wrapError(e); }
   }
 
+  async updateVisibility(input: UpdateVisibilityInput): Promise<Environment> {
+    try {
+      return await this.command.updateVisibility(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
   async delete(input: DeleteResourceInput): Promise<Environment> {
     try {
       return await this.command.delete(create(ApiResourceDeleteInputSchema, {

package/src/gen/platformclient.ts

@@ -14,7 +14,7 @@ import { PlatformClientCommandController } from "@stigmer/protos/ai/stigmer/iam/
 import { PlatformClientCreateResponseSchema, PlatformClientIdSchema, ListPlatformClientsByOrgInputSchema, PlatformClientsSchema, type PlatformClientCreateResponse, type ListPlatformClientsByOrgInput, type PlatformClients } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/io_pb";
 import { PlatformClientQueryController } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/query_pb";
 import { PlatformClientSpecSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/spec_pb";
-import { PlatformClientTokenController, MintUserTokenRequestSchema, MintUserTokenResponseSchema, type MintUserTokenRequest, type MintUserTokenResponse } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
+import { PlatformClientTokenController, MintUserTokenRequestSchema, MintUserTokenResponseSchema, MintGuestTokenRequestSchema, MintGuestTokenResponseSchema, type MintUserTokenRequest, type MintUserTokenResponse, type MintGuestTokenRequest, type MintGuestTokenResponse } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
 /** Provides operations on platformclient resources. */
@@ -80,6 +80,12 @@ export class PlatformClientClient {
       return await this.token.mintUserToken(input);
     } catch (e) { throw wrapError(e); }
   }
+
+  async mintGuestToken(input: MintGuestTokenRequest): Promise<MintGuestTokenResponse> {
+    try {
+      return await this.token.mintGuestToken(input);
+    } catch (e) { throw wrapError(e); }
+  }
 }
 
 /** Input for creating/updating a PlatformClient. */

package/src/gen/session.ts

@@ -9,7 +9,7 @@ import { ToolApprovalOverrideSchema, McpServerUsageSchema } from "@stigmer/proto
 import { SessionSchema, type Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { SessionCommandController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/command_pb";
 import { Harness, CursorMode, ExecutionTarget, GitWriteBackMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
-import { SessionIdSchema, UpdateSessionSubjectRequestSchema, ListSessionsRequestSchema, SessionListSchema, ListSessionsByAgentRequestSchema, type UpdateSessionSubjectRequest, type ListSessionsRequest, type SessionList, type ListSessionsByAgentRequest } from "@stigmer/protos/ai/stigmer/agentic/session/v1/io_pb";
+import { SessionIdSchema, UpdateSessionSubjectRequestSchema, ListSessionsRequestSchema, SessionListSchema, ListSessionsByAgentInstanceRequestSchema, type UpdateSessionSubjectRequest, type ListSessionsRequest, type SessionList, type ListSessionsByAgentInstanceRequest } from "@stigmer/protos/ai/stigmer/agentic/session/v1/io_pb";
 import { SessionQueryController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/query_pb";
 import { SessionSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/spec_pb";
 import { GitRepoSourceSchema, LocalPathSourceSchema, WorkspaceSourceSchema, WorkspaceEntrySchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
@@ -69,9 +69,9 @@ export class SessionClient {
     } catch (e) { throw wrapError(e); }
   }
 
-  async listByAgent(input: ListSessionsByAgentRequest): Promise<SessionList> {
+  async listByAgentInstance(input: ListSessionsByAgentInstanceRequest): Promise<SessionList> {
     try {
-      return await this.query.listByAgent(input);
+      return await this.query.listByAgentInstance(input);
     } catch (e) { throw wrapError(e); }
   }
 }