@stigmer/sdk 3.12.4 → 3.12.6

package/src/gen/environment.ts

@@ -1,7 +1,7 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toEnvVarInputMap } from "./proto-utils.js";
 import { type DeleteResourceInput, type ResourceRef, type EnvVarInput } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
@@ -98,6 +98,14 @@ export class EnvironmentClient {
 
 /** Input for creating/updating a Environment. */
 export interface EnvironmentInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -117,6 +125,7 @@ export function buildEnvironmentProto(input: EnvironmentInput): Environment {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "Environment",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -129,3 +138,33 @@ export function buildEnvironmentProto(input: EnvironmentInput): Environment {
     })),
   }) as Environment;
 }
+
+/**
+ * Maps a fetched {@link Environment} to a complete {@link EnvironmentInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toEnvironmentUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toEnvironmentUpdateInput(resource: Environment): EnvironmentInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(EnvironmentSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    description: spec.description || undefined,
+    data: toEnvVarInputMap(spec.data),
+  };
+}

package/src/gen/executioncontext.ts

@@ -68,6 +68,14 @@ export class ExecutionContextClient {
 
 /** Input for creating/updating a ExecutionContext. */
 export interface ExecutionContextInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -87,6 +95,7 @@ export function buildExecutionContextProto(input: ExecutionContextInput): Execut
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "ExecutionContext",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),

package/src/gen/iampolicy.ts

@@ -109,6 +109,14 @@ export class IamPolicyClient {
 
 /** Input for creating/updating a IamPolicy. */
 export interface IamPolicyInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -141,6 +149,7 @@ export function buildIamPolicyProto(input: IamPolicyInput): IamPolicy {
     apiVersion: "iam.stigmer.ai/v1",
     kind: "IamPolicy",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),

package/src/gen/identityaccount.ts

@@ -1,7 +1,7 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toResourceRefInput } from "./proto-utils.js";
 import { type ResourceRef } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { EmptySchema } from "@bufbuild/protobuf/wkt";
@@ -15,7 +15,7 @@ import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 import { IdentityAccountIdSchema, CreateFederatedAccountInputSchema, UpdateFederatedAccountInputSchema, DeprovisionFederatedAccountInputSchema, IdentityAccountEmailSchema, IdpIdSchema, ExternalSubLookupSchema, type CreateFederatedAccountInput, type UpdateFederatedAccountInput, type DeprovisionFederatedAccountInput, type IdentityAccountEmail, type ExternalSubLookup } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/io_pb";
 import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
-import { IdentityAccountSpecSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { IdentityAccountSpecSchema, IdentityAccountPreferencesSchema, type IdentityAccountPreferences } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
 
 /** Provides operations on identityaccount resources. */
 export class IdentityAccountClient {
@@ -108,6 +108,14 @@ export class IdentityAccountClient {
 
 /** Input for creating/updating a IdentityAccount. */
 export interface IdentityAccountInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -121,14 +129,34 @@ export interface IdentityAccountInput {
   isMachineAccount?: boolean;
   provisioningMode?: IdentityAccountProvisioningMode;
   identityProviderRef?: ResourceRef;
+  preferences?: IdentityAccountPreferencesInput;
+}
+
+/** SDK input type for IdentityAccountPreferences. */
+export interface IdentityAccountPreferencesInput {
+  standingContext?: string;
+  defaultHarness?: string;
+  defaultNativeModel?: string;
+  defaultCursorModel?: string;
+}
+
+function buildIdentityAccountPreferencesProto(input: IdentityAccountPreferencesInput) {
+  return Object.assign(create(IdentityAccountPreferencesSchema), stripUndefined({
+    standingContext: input.standingContext,
+    defaultHarness: input.defaultHarness,
+    defaultNativeModel: input.defaultNativeModel,
+    defaultCursorModel: input.defaultCursorModel,
+  }));
 }
 
 export function buildIdentityAccountProto(input: IdentityAccountInput): IdentityAccount {
   const identityProviderRef = (input.identityProviderRef?.slug || input.identityProviderRef?.org) ? create(ApiResourceReferenceSchema, input.identityProviderRef) : undefined;
+  const preferences = input.preferences ? buildIdentityAccountPreferencesProto(input.preferences) : undefined;
   return Object.assign(create(IdentityAccountSchema), {
     apiVersion: "iam.stigmer.ai/v1",
     kind: "IdentityAccount",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -144,6 +172,53 @@ export function buildIdentityAccountProto(input: IdentityAccountInput): Identity
       isMachineAccount: input.isMachineAccount,
       provisioningMode: input.provisioningMode,
       identityProviderRef,
+      preferences,
     })),
   }) as IdentityAccount;
 }
+
+function toIdentityAccountPreferencesInput(msg: IdentityAccountPreferences): IdentityAccountPreferencesInput {
+  return {
+    standingContext: msg.standingContext || undefined,
+    defaultHarness: msg.defaultHarness || undefined,
+    defaultNativeModel: msg.defaultNativeModel || undefined,
+    defaultCursorModel: msg.defaultCursorModel || undefined,
+  };
+}
+
+/**
+ * Maps a fetched {@link IdentityAccount} to a complete {@link IdentityAccountInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toIdentityAccountUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toIdentityAccountUpdateInput(resource: IdentityAccount): IdentityAccountInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(IdentityAccountSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    idpId: spec.idpId ?? "",
+    email: spec.email || undefined,
+    firstName: spec.firstName || undefined,
+    lastName: spec.lastName || undefined,
+    pictureUrl: spec.pictureUrl || undefined,
+    isMachineAccount: spec.isMachineAccount || undefined,
+    provisioningMode: spec.provisioningMode || undefined,
+    identityProviderRef: toResourceRefInput(spec.identityProviderRef),
+    preferences: spec.preferences ? toIdentityAccountPreferencesInput(spec.preferences) : undefined,
+  };
+}

package/src/gen/identityprovider.ts

@@ -81,6 +81,14 @@ export class IdentityProviderClient {
 
 /** Input for creating/updating a IdentityProvider. */
 export interface IdentityProviderInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -105,6 +113,7 @@ export function buildIdentityProviderProto(input: IdentityProviderInput): Identi
     apiVersion: "iam.stigmer.ai/v1",
     kind: "IdentityProvider",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -127,3 +136,43 @@ export function buildIdentityProviderProto(input: IdentityProviderInput): Identi
     })),
   }) as IdentityProvider;
 }
+
+/**
+ * Maps a fetched {@link IdentityProvider} to a complete {@link IdentityProviderInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toIdentityProviderUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toIdentityProviderUpdateInput(resource: IdentityProvider): IdentityProviderInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(IdentityProviderSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    displayName: spec.displayName || undefined,
+    jwksUri: spec.jwksUri || undefined,
+    allowedIssuers: spec.allowedIssuers?.length ? [...spec.allowedIssuers] : undefined,
+    expectedAudience: spec.expectedAudience || undefined,
+    rateLimitBudget: spec.rateLimitBudget || undefined,
+    userinfoEndpoint: spec.userinfoEndpoint || undefined,
+    isSsoProvider: spec.isSsoProvider || undefined,
+    oidcClientId: spec.oidcClientId || undefined,
+    autoProvisionAccounts: spec.autoProvisionAccounts || undefined,
+    autoGrantOnOrg: spec.autoGrantOnOrg || undefined,
+    autoGrantRole: spec.autoGrantRole || undefined,
+    tenantOrgClaim: spec.tenantOrgClaim || undefined,
+  };
+}

package/src/gen/invitation.ts

@@ -62,6 +62,14 @@ export class InvitationClient {
 
 /** Input for creating/updating a Invitation. */
 export interface InvitationInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -79,6 +87,7 @@ export function buildInvitationProto(input: InvitationInput): Invitation {
     apiVersion: "iam.stigmer.ai/v1",
     kind: "Invitation",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),

package/src/gen/mcpserver.ts

@@ -1,16 +1,16 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toResourceRefInput } from "./proto-utils.js";
 import { type DeleteResourceInput, type ListParams, type ListResult, type ResourceRef } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
-import { EnvVarDeclarationSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+import { EnvVarDeclarationSchema, type EnvVarDeclaration } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
 import { McpServerSchema, type McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
 import { ConnectInputSchema, InitiateOAuthConnectInputSchema, InitiateOAuthConnectOutputSchema, CompleteOAuthConnectInputSchema, CompleteOAuthConnectOutputSchema, DisconnectOAuthInputSchema, DisconnectOAuthOutputSchema, SetOrgOAuthAppInputSchema, SetOrgOAuthAppOutputSchema, DeleteOrgOAuthAppInputSchema, DeleteOrgOAuthAppOutputSchema, GetOAuthGrantStatusInputSchema, GetOAuthGrantStatusOutputSchema, GetOrgOAuthAppInputSchema, GetOrgOAuthAppOutputSchema, type ConnectInput, type InitiateOAuthConnectInput, type InitiateOAuthConnectOutput, type CompleteOAuthConnectInput, type CompleteOAuthConnectOutput, type DisconnectOAuthInput, type DisconnectOAuthOutput, type SetOrgOAuthAppInput, type SetOrgOAuthAppOutput, type DeleteOrgOAuthAppInput, type DeleteOrgOAuthAppOutput, type GetOAuthGrantStatusInput, type GetOAuthGrantStatusOutput, type GetOrgOAuthAppInput, type GetOrgOAuthAppOutput } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
 import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
-import { McpServerSpecSchema, StdioServerConfigSchema, HttpServerConfigSchema, ToolApprovalPolicySchema, McpServerAuthSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import { McpServerSpecSchema, StdioServerConfigSchema, HttpServerConfigSchema, ToolApprovalPolicySchema, McpServerAuthSchema, type StdioServerConfig, type HttpServerConfig, type ToolApprovalPolicy, type McpServerAuth } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceIdSchema, ApiResourceReferenceSchema, ApiResourceDeleteInputSchema, type UpdateVisibilityInput } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
@@ -71,6 +71,12 @@ export class McpServerClient {
     } catch (e) { throw wrapError(e); }
   }
 
+  async startConnect(input: ConnectInput): Promise<McpServer> {
+    try {
+      return await this.command.startConnect(input);
+    } catch (e) { throw wrapError(e); }
+  }
+
   async initiateOAuthConnect(input: InitiateOAuthConnectInput): Promise<InitiateOAuthConnectOutput> {
     try {
       return await this.command.initiateOAuthConnect(input);
@@ -146,6 +152,14 @@ export class McpServerClient {
 
 /** Input for creating/updating a McpServer. */
 export interface McpServerInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -274,6 +288,7 @@ export function buildMcpServerProto(input: McpServerInput): McpServer {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "McpServer",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -283,3 +298,86 @@ export function buildMcpServerProto(input: McpServerInput): McpServer {
     spec,
   }) as McpServer;
 }
+
+function toStdioServerConfigInput(msg: StdioServerConfig): StdioServerConfigInput {
+  return {
+    command: msg.command ?? "",
+    args: msg.args?.length ? [...msg.args] : undefined,
+    workingDir: msg.workingDir || undefined,
+  };
+}
+
+function toHttpServerConfigInput(msg: HttpServerConfig): HttpServerConfigInput {
+  return {
+    url: msg.url ?? "",
+    headers: Object.keys(msg.headers ?? {}).length > 0 ? { ...msg.headers } : undefined,
+    queryParams: Object.keys(msg.queryParams ?? {}).length > 0 ? { ...msg.queryParams } : undefined,
+    timeoutSeconds: msg.timeoutSeconds || undefined,
+  };
+}
+
+function toEnvVarDeclarationInput(msg: EnvVarDeclaration): EnvVarDeclarationInput {
+  return {
+    isSecret: msg.isSecret || undefined,
+    description: msg.description || undefined,
+    optional: msg.optional || undefined,
+  };
+}
+
+function toToolApprovalPolicyInput(msg: ToolApprovalPolicy): ToolApprovalPolicyInput {
+  return {
+    toolName: msg.toolName || undefined,
+    message: msg.message || undefined,
+    fromDestructiveHint: msg.fromDestructiveHint || undefined,
+  };
+}
+
+function toMcpServerAuthInput(msg: McpServerAuth): McpServerAuthInput {
+  return {
+    oauthAppRef: toResourceRefInput(msg.oauthAppRef),
+    targetEnvVar: msg.targetEnvVar || undefined,
+    tokenLifetimeHint: msg.tokenLifetimeHint || undefined,
+    scopeHints: msg.scopeHints?.length ? [...msg.scopeHints] : undefined,
+    discoveryUrl: msg.discoveryUrl || undefined,
+    oauthOnly: msg.oauthOnly || undefined,
+  };
+}
+
+/**
+ * Maps a fetched {@link McpServer} to a complete {@link McpServerInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toMcpServerUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toMcpServerUpdateInput(resource: McpServer): McpServerInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(McpServerSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    description: spec.description || undefined,
+    iconUrl: spec.iconUrl || undefined,
+    tags: spec.tags?.length ? [...spec.tags] : undefined,
+    stdio: spec.serverType?.case === "stdio" ? toStdioServerConfigInput(spec.serverType.value) : undefined,
+    http: spec.serverType?.case === "http" ? toHttpServerConfigInput(spec.serverType.value) : undefined,
+    defaultEnabledTools: spec.defaultEnabledTools?.length ? [...spec.defaultEnabledTools] : undefined,
+    env: Object.keys(spec.env ?? {}).length > 0 ? Object.fromEntries(Object.entries(spec.env).map(([k, v]) => [k, toEnvVarDeclarationInput(v)])) : undefined,
+    pinnedToolApprovals: spec.pinnedToolApprovals?.length ? spec.pinnedToolApprovals.map(toToolApprovalPolicyInput) : undefined,
+    repositoryUrl: spec.repositoryUrl || undefined,
+    githubStars: spec.githubStars || undefined,
+    auth: spec.auth ? toMcpServerAuthInput(spec.auth) : undefined,
+  };
+}

package/src/gen/oauthapp.ts

@@ -13,7 +13,7 @@ import { OAuthAppSchema, type OAuthApp } from "@stigmer/protos/ai/stigmer/iam/oa
 import { OAuthAppCommandController } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/command_pb";
 import { ListOAuthAppsByOrgInputSchema, OAuthAppsSchema, type ListOAuthAppsByOrgInput, type OAuthApps } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/io_pb";
 import { OAuthAppQueryController } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/query_pb";
-import { OAuthAppSpecSchema, VendorApprovalStatus } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
+import { OAuthAppSpecSchema, VendorApprovalStatus, TokenEndpointAuthMethod } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
 
 /** Provides operations on oauthapp resources. */
 export class OAuthAppClient {
@@ -74,6 +74,14 @@ export class OAuthAppClient {
 
 /** Input for creating/updating a OAuthApp. */
 export interface OAuthAppInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -89,6 +97,7 @@ export interface OAuthAppInput {
   scopeParameterName?: string;
   vendorApprovalStatus?: VendorApprovalStatus;
   vendorApprovalDocsUrl?: string;
+  tokenEndpointAuthMethod?: TokenEndpointAuthMethod;
 }
 
 export function buildOAuthAppProto(input: OAuthAppInput): OAuthApp {
@@ -96,6 +105,7 @@ export function buildOAuthAppProto(input: OAuthAppInput): OAuthApp {
     apiVersion: "iam.stigmer.ai/v1",
     kind: "OAuthApp",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -113,6 +123,46 @@ export function buildOAuthAppProto(input: OAuthAppInput): OAuthApp {
       scopeParameterName: input.scopeParameterName,
       vendorApprovalStatus: input.vendorApprovalStatus,
       vendorApprovalDocsUrl: input.vendorApprovalDocsUrl,
+      tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
     })),
   }) as OAuthApp;
 }
+
+/**
+ * Maps a fetched {@link OAuthApp} to a complete {@link OAuthAppInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toOAuthAppUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toOAuthAppUpdateInput(resource: OAuthApp): OAuthAppInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(OAuthAppSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    provider: spec.provider || undefined,
+    clientId: spec.clientId || undefined,
+    clientSecret: spec.clientSecret || undefined,
+    authorizationUrl: spec.authorizationUrl || undefined,
+    tokenUrl: spec.tokenUrl || undefined,
+    scopes: spec.scopes?.length ? [...spec.scopes] : undefined,
+    userinfoUrl: spec.userinfoUrl || undefined,
+    scopeParameterName: spec.scopeParameterName || undefined,
+    vendorApprovalStatus: spec.vendorApprovalStatus || undefined,
+    vendorApprovalDocsUrl: spec.vendorApprovalDocsUrl || undefined,
+    tokenEndpointAuthMethod: spec.tokenEndpointAuthMethod || undefined,
+  };
+}

package/src/gen/organization.ts

@@ -1,7 +1,7 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toResourceRefInput } from "./proto-utils.js";
 import { type ResourceRef } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { EmptySchema } from "@bufbuild/protobuf/wkt";
@@ -14,7 +14,7 @@ import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenanc
 import { ManagementMode } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/enum_pb";
 import { OrganizationIdSchema, OrganizationListSchema, OrganizationsSchema, OrganizationExternalLookupSchema, type OrganizationList, type Organizations, type OrganizationExternalLookup } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/io_pb";
 import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
-import { OrganizationSpecSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/spec_pb";
+import { OrganizationSpecSchema, OrganizationPreferencesSchema, type OrganizationPreferences } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/spec_pb";
 
 /** Provides operations on organization resources. */
 export class OrganizationClient {
@@ -77,6 +77,14 @@ export class OrganizationClient {
 
 /** Input for creating/updating a Organization. */
 export interface OrganizationInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -88,14 +96,28 @@ export interface OrganizationInput {
   identityProviderRef?: ResourceRef;
   externalOrgId?: string;
   isPersonal?: boolean;
+  preferences?: OrganizationPreferencesInput;
+}
+
+/** SDK input type for OrganizationPreferences. */
+export interface OrganizationPreferencesInput {
+  standingContext?: string;
+}
+
+function buildOrganizationPreferencesProto(input: OrganizationPreferencesInput) {
+  return Object.assign(create(OrganizationPreferencesSchema), stripUndefined({
+    standingContext: input.standingContext,
+  }));
 }
 
 export function buildOrganizationProto(input: OrganizationInput): Organization {
   const identityProviderRef = (input.identityProviderRef?.slug || input.identityProviderRef?.org) ? create(ApiResourceReferenceSchema, input.identityProviderRef) : undefined;
+  const preferences = input.preferences ? buildOrganizationPreferencesProto(input.preferences) : undefined;
   return Object.assign(create(OrganizationSchema), {
     apiVersion: "tenancy.stigmer.ai/v1",
     kind: "Organization",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -109,6 +131,48 @@ export function buildOrganizationProto(input: OrganizationInput): Organization {
       identityProviderRef,
       externalOrgId: input.externalOrgId,
       isPersonal: input.isPersonal,
+      preferences,
     })),
   }) as Organization;
 }
+
+function toOrganizationPreferencesInput(msg: OrganizationPreferences): OrganizationPreferencesInput {
+  return {
+    standingContext: msg.standingContext || undefined,
+  };
+}
+
+/**
+ * Maps a fetched {@link Organization} to a complete {@link OrganizationInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toOrganizationUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toOrganizationUpdateInput(resource: Organization): OrganizationInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(OrganizationSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org || meta?.slug || "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    description: spec.description || undefined,
+    logoUrl: spec.logoUrl || undefined,
+    managementMode: spec.managementMode || undefined,
+    identityProviderRef: toResourceRefInput(spec.identityProviderRef),
+    externalOrgId: spec.externalOrgId || undefined,
+    isPersonal: spec.isPersonal || undefined,
+    preferences: spec.preferences ? toOrganizationPreferencesInput(spec.preferences) : undefined,
+  };
+}