@stigmer/sdk 3.12.4 → 3.12.6

package/src/gen/platformclient.ts

@@ -1,9 +1,10 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined, toTimestamp } from "./proto-utils.js";
+import { stripUndefined, toTimestamp, toResourceRefInputs } from "./proto-utils.js";
 import { type DeleteResourceInput, type ResourceRef } from "./types.js";
 import { create } from "@bufbuild/protobuf";
+import { timestampDate } from "@bufbuild/protobuf/wkt";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
@@ -90,6 +91,14 @@ export class PlatformClientClient {
 
 /** Input for creating/updating a PlatformClient. */
 export interface PlatformClientInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -104,14 +113,17 @@ export interface PlatformClientInput {
   autoGrantOnOrg?: boolean;
   autoGrantRole?: IamRole;
   allowedOrigins?: string[];
+  environmentRefs?: ResourceRef[];
 }
 
 export function buildPlatformClientProto(input: PlatformClientInput): PlatformClient {
   const expiresAt = input.expiresAt !== undefined ? toTimestamp(input.expiresAt) : undefined;
+  const environmentRefs = input.environmentRefs?.map(r => create(ApiResourceReferenceSchema, { ...r, kind: 53 }));
   return Object.assign(create(PlatformClientSchema), {
     apiVersion: "iam.stigmer.ai/v1",
     kind: "PlatformClient",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -128,6 +140,45 @@ export function buildPlatformClientProto(input: PlatformClientInput): PlatformCl
       autoGrantOnOrg: input.autoGrantOnOrg,
       autoGrantRole: input.autoGrantRole,
       allowedOrigins: input.allowedOrigins,
+      environmentRefs,
     })),
   }) as PlatformClient;
 }
+
+/**
+ * Maps a fetched {@link PlatformClient} to a complete {@link PlatformClientInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toPlatformClientUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toPlatformClientUpdateInput(resource: PlatformClient): PlatformClientInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(PlatformClientSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    clientId: spec.clientId || undefined,
+    clientSecretHash: spec.clientSecretHash || undefined,
+    secretFingerprint: spec.secretFingerprint || undefined,
+    expiresAt: spec.expiresAt ? timestampDate(spec.expiresAt) : undefined,
+    neverExpires: spec.neverExpires || undefined,
+    autoProvisionAccounts: spec.autoProvisionAccounts || undefined,
+    autoGrantOnOrg: spec.autoGrantOnOrg || undefined,
+    autoGrantRole: spec.autoGrantRole || undefined,
+    allowedOrigins: spec.allowedOrigins?.length ? [...spec.allowedOrigins] : undefined,
+    environmentRefs: toResourceRefInputs(spec.environmentRefs),
+  };
+}

package/src/gen/project.ts

@@ -1,7 +1,7 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toResourceRefInputs } from "./proto-utils.js";
 import { type ResourceRef } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
@@ -64,6 +64,14 @@ export class ProjectClient {
 
 /** Input for creating/updating a Project. */
 export interface ProjectInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -80,6 +88,7 @@ export function buildProjectProto(input: ProjectInput): Project {
     apiVersion: "tenancy.stigmer.ai/v1",
     kind: "Project",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -93,3 +102,34 @@ export function buildProjectProto(input: ProjectInput): Project {
     })),
   }) as Project;
 }
+
+/**
+ * Maps a fetched {@link Project} to a complete {@link ProjectInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toProjectUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toProjectUpdateInput(resource: Project): ProjectInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(ProjectSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    entryPoint: spec.entryPoint || undefined,
+    description: spec.description || undefined,
+    members: toResourceRefInputs(spec.members),
+  };
+}

package/src/gen/proto-utils.ts

@@ -1,6 +1,10 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { timestampFromDate, type Timestamp } from "@bufbuild/protobuf/wkt";
+import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import type { EnvironmentSpec, EnvironmentValue } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+import type { ExecutionValue } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/spec_pb";
+import type { EnvSpecInput, EnvVarInput, ResourceRef } from "./types.js";
 
 /**
  * Remove keys whose values are `undefined` so that `Object.assign`
@@ -24,3 +28,63 @@ export function toTimestamp(value: Date | string): Timestamp {
   const date = value instanceof Date ? value : new Date(value);
   return timestampFromDate(date);
 }
+
+/**
+ * Narrow a fetched ApiResourceReference to the ResourceRef input shape,
+ * or `undefined` when the reference is absent/empty (the builders treat a
+ * ref without org and slug as "no reference"). `version` is preserved —
+ * dropping it would reset a pinned reference to "latest". `kind` is also
+ * preserved: builders overwrite it where the proto annotates a reference
+ * kind, but refs without that annotation (e.g. an organization's
+ * identityProviderRef) carry the stored kind, so dropping it would be
+ * lossy.
+ */
+export function toResourceRefInput(ref: ApiResourceReference | undefined): ResourceRef | undefined {
+  if (!ref || (!ref.org && !ref.slug)) return undefined;
+  return {
+    org: ref.org,
+    slug: ref.slug,
+    ...(ref.version && { version: ref.version }),
+    ...(ref.kind && { kind: ref.kind }),
+  };
+}
+
+/**
+ * Map a repeated ApiResourceReference to ResourceRef inputs, or `undefined`
+ * when the list is absent/empty (the mappers' canonical shape for empty
+ * lists).
+ */
+export function toResourceRefInputs(refs: ApiResourceReference[] | undefined): ResourceRef[] | undefined {
+  if (!refs || refs.length === 0) return undefined;
+  return refs.map((r) => toResourceRefInput(r) ?? { org: "", slug: "" });
+}
+
+/**
+ * Convert a fetched EnvironmentSpec to the EnvSpecInput shape, or
+ * `undefined` when absent/empty.
+ */
+export function toEnvSpecInput(spec: EnvironmentSpec | undefined): EnvSpecInput | undefined {
+  if (!spec) return undefined;
+  const variables = toEnvVarInputMap(spec.data);
+  return variables ? { variables } : undefined;
+}
+
+/**
+ * Convert a map of EnvironmentValue to EnvVarInput entries, or `undefined`
+ * when the map is absent/empty.
+ */
+export function toEnvVarInputMap(data: Record<string, EnvironmentValue> | undefined): Record<string, EnvVarInput> | undefined {
+  if (!data || Object.keys(data).length === 0) return undefined;
+  return Object.fromEntries(Object.entries(data).map(([k, v]) =>
+    [k, { value: v.value, isSecret: v.isSecret || undefined, description: v.description || undefined }]));
+}
+
+/**
+ * Convert a map of ExecutionValue to EnvVarInput entries, or `undefined`
+ * when the map is absent/empty.
+ */
+export function toExecVarInputMap(data: Record<string, ExecutionValue> | undefined): Record<string, EnvVarInput> | undefined {
+  if (!data || Object.keys(data).length === 0) return undefined;
+  return Object.fromEntries(Object.entries(data).map(([k, v]) =>
+    [k, { value: v.value, isSecret: v.isSecret || undefined }]));
+}

package/src/gen/schedule.ts

@@ -1,19 +1,19 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toResourceRefInput, toResourceRefInputs } from "./proto-utils.js";
 import { type ResourceRef } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
-import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { RunConfigSchema, AgentInvocationSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/invocation_pb";
+import { ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { RunConfigSchema, AgentInvocationSchema, type RunConfig, type AgentInvocation } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/invocation_pb";
 import { ScheduleSchema, type Schedule } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import { ScheduleCommandController } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/command_pb";
 import { ScheduleIdSchema, ScheduleTriggerResultSchema, GetSchedulesByAgentRequestSchema, ScheduleListSchema, ListSchedulesRequestSchema, ListScheduleRunsRequestSchema, ScheduleRunListSchema, type ScheduleTriggerResult, type GetSchedulesByAgentRequest, type ScheduleList, type ListSchedulesRequest, type ListScheduleRunsRequest, type ScheduleRunList } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/io_pb";
 import { ScheduleQueryController } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/query_pb";
 import { ScheduleSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/spec_pb";
 import { Harness, GitWriteBackMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
-import { GitRepoSourceSchema, LocalPathSourceSchema, WorkspaceSourceSchema, WorkspaceEntrySchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
+import { GitRepoSourceSchema, LocalPathSourceSchema, WorkspaceSourceSchema, WorkspaceEntrySchema, type GitRepoSource, type LocalPathSource, type WorkspaceSource, type WorkspaceEntry } from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
@@ -98,6 +98,14 @@ export class ScheduleClient {
 
 /** Input for creating/updating a Schedule. */
 export interface ScheduleInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -151,6 +159,7 @@ export interface RunConfigInput {
   maxCostUsd?: number;
   maxToolRounds?: number;
   serviceTier?: ServiceTier;
+  thinkingMode?: ThinkingMode;
 }
 
 function buildGitRepoSourceProto(input: GitRepoSourceInput) {
@@ -192,6 +201,7 @@ function buildRunConfigProto(input: RunConfigInput) {
     maxCostUsd: input.maxCostUsd,
     maxToolRounds: input.maxToolRounds,
     serviceTier: input.serviceTier,
+    thinkingMode: input.thinkingMode,
   }));
 }
 
@@ -219,6 +229,7 @@ export function buildScheduleProto(input: ScheduleInput): Schedule {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "Schedule",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -228,3 +239,86 @@ export function buildScheduleProto(input: ScheduleInput): Schedule {
     spec,
   }) as Schedule;
 }
+
+function toGitRepoSourceInput(msg: GitRepoSource): GitRepoSourceInput {
+  return {
+    url: msg.url ?? "",
+    branch: msg.branch || undefined,
+    commit: msg.commit || undefined,
+    depth: msg.depth || undefined,
+    writeBackMode: msg.writeBackMode || undefined,
+  };
+}
+
+function toLocalPathSourceInput(msg: LocalPathSource): LocalPathSourceInput {
+  return {
+    path: msg.path || undefined,
+  };
+}
+
+function toWorkspaceSourceInput(msg: WorkspaceSource): WorkspaceSourceInput {
+  return {
+    gitRepo: msg.source?.case === "gitRepo" ? toGitRepoSourceInput(msg.source.value) : undefined,
+    localPath: msg.source?.case === "localPath" ? toLocalPathSourceInput(msg.source.value) : undefined,
+  };
+}
+
+function toWorkspaceEntryInput(msg: WorkspaceEntry): WorkspaceEntryInput {
+  return {
+    name: msg.name || undefined,
+    source: toWorkspaceSourceInput(msg.source ?? create(WorkspaceSourceSchema)),
+  };
+}
+
+function toRunConfigInput(msg: RunConfig): RunConfigInput {
+  return {
+    modelName: msg.modelName || undefined,
+    maxCostUsd: msg.maxCostUsd || undefined,
+    maxToolRounds: msg.maxToolRounds || undefined,
+    serviceTier: msg.serviceTier || undefined,
+    thinkingMode: msg.thinkingMode || undefined,
+  };
+}
+
+function toAgentInvocationInput(msg: AgentInvocation): AgentInvocationInput {
+  return {
+    agentRef: toResourceRefInput(msg.agentRef) ?? { org: "", slug: "" },
+    message: msg.message || undefined,
+    harness: msg.harness || undefined,
+    workspaceEntries: msg.workspaceEntries?.length ? msg.workspaceEntries.map(toWorkspaceEntryInput) : undefined,
+    environmentRefs: toResourceRefInputs(msg.environmentRefs),
+    runConfig: msg.runConfig ? toRunConfigInput(msg.runConfig) : undefined,
+  };
+}
+
+/**
+ * Maps a fetched {@link Schedule} to a complete {@link ScheduleInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toScheduleUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toScheduleUpdateInput(resource: Schedule): ScheduleInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(ScheduleSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    cron: spec.cron || undefined,
+    timeZone: spec.timeZone || undefined,
+    enabled: spec.enabled || undefined,
+    agent: spec.target?.case === "agent" ? toAgentInvocationInput(spec.target.value) : undefined,
+  };
+}

package/src/gen/session.ts

@@ -1,18 +1,18 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toResourceRefInput, toResourceRefInputs } from "./proto-utils.js";
 import { type ResourceRef } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
-import { ToolApprovalOverrideSchema, McpServerUsageSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import { ToolApprovalOverrideSchema, McpServerUsageSchema, type ToolApprovalOverride, type McpServerUsage } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import { SessionSchema, type Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { SessionCommandController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/command_pb";
 import { Harness, CursorMode, ExecutionTarget, GitWriteBackMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { SessionIdSchema, UpdateSessionSubjectRequestSchema, ListSessionsRequestSchema, SessionListSchema, ListSessionsByAgentInstanceRequestSchema, ListSessionsByChannelRequestSchema, type UpdateSessionSubjectRequest, type ListSessionsRequest, type SessionList, type ListSessionsByAgentInstanceRequest, type ListSessionsByChannelRequest } from "@stigmer/protos/ai/stigmer/agentic/session/v1/io_pb";
 import { SessionQueryController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/query_pb";
 import { SessionSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/spec_pb";
-import { GitRepoSourceSchema, LocalPathSourceSchema, WorkspaceSourceSchema, WorkspaceEntrySchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
+import { GitRepoSourceSchema, LocalPathSourceSchema, WorkspaceSourceSchema, WorkspaceEntrySchema, type GitRepoSource, type LocalPathSource, type WorkspaceSource, type WorkspaceEntry } from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
@@ -84,6 +84,14 @@ export class SessionClient {
 
 /** Input for creating/updating a Session. */
 export interface SessionInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -199,6 +207,7 @@ export function buildSessionProto(input: SessionInput): Session {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "Session",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -220,3 +229,88 @@ export function buildSessionProto(input: SessionInput): Session {
     })),
   }) as Session;
 }
+
+function toGitRepoSourceInput(msg: GitRepoSource): GitRepoSourceInput {
+  return {
+    url: msg.url ?? "",
+    branch: msg.branch || undefined,
+    commit: msg.commit || undefined,
+    depth: msg.depth || undefined,
+    writeBackMode: msg.writeBackMode || undefined,
+  };
+}
+
+function toLocalPathSourceInput(msg: LocalPathSource): LocalPathSourceInput {
+  return {
+    path: msg.path || undefined,
+  };
+}
+
+function toWorkspaceSourceInput(msg: WorkspaceSource): WorkspaceSourceInput {
+  return {
+    gitRepo: msg.source?.case === "gitRepo" ? toGitRepoSourceInput(msg.source.value) : undefined,
+    localPath: msg.source?.case === "localPath" ? toLocalPathSourceInput(msg.source.value) : undefined,
+  };
+}
+
+function toWorkspaceEntryInput(msg: WorkspaceEntry): WorkspaceEntryInput {
+  return {
+    name: msg.name || undefined,
+    source: toWorkspaceSourceInput(msg.source ?? create(WorkspaceSourceSchema)),
+  };
+}
+
+function toToolApprovalOverrideInput(msg: ToolApprovalOverride): ToolApprovalOverrideInput {
+  return {
+    toolName: msg.toolName || undefined,
+    requiresApproval: msg.requiresApproval || undefined,
+    message: msg.message || undefined,
+  };
+}
+
+function toMcpServerUsageInput(msg: McpServerUsage): McpServerUsageInput {
+  return {
+    mcpServerRef: toResourceRefInput(msg.mcpServerRef) ?? { org: "", slug: "" },
+    enabledTools: msg.enabledTools?.length ? [...msg.enabledTools] : undefined,
+    toolApprovalOverrides: msg.toolApprovalOverrides?.length ? msg.toolApprovalOverrides.map(toToolApprovalOverrideInput) : undefined,
+  };
+}
+
+/**
+ * Maps a fetched {@link Session} to a complete {@link SessionInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toSessionUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toSessionUpdateInput(resource: Session): SessionInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(SessionSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    agentInstanceId: spec.agentInstanceId || undefined,
+    subject: spec.subject || undefined,
+    harnessStateId: spec.harnessStateId || undefined,
+    harnessStateIdHistory: spec.harnessStateIdHistory?.length ? [...spec.harnessStateIdHistory] : undefined,
+    metadata: Object.keys(spec.metadata ?? {}).length > 0 ? { ...spec.metadata } : undefined,
+    workspaceEntries: spec.workspaceEntries?.length ? spec.workspaceEntries.map(toWorkspaceEntryInput) : undefined,
+    mcpServerUsages: spec.mcpServerUsages?.length ? spec.mcpServerUsages.map(toMcpServerUsageInput) : undefined,
+    skillRefs: toResourceRefInputs(spec.skillRefs),
+    harness: spec.harness || undefined,
+    cursorMode: spec.cursorMode || undefined,
+    executionTarget: spec.executionTarget || undefined,
+  };
+}

package/src/gen/skill.ts

@@ -111,6 +111,14 @@ export class SkillClient {
 
 /** Input for creating/updating a Skill. */
 export interface SkillInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -127,6 +135,7 @@ export function buildSkillProto(input: SkillInput): Skill {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "Skill",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),

package/src/gen/workflow.ts

@@ -5,14 +5,14 @@ import { stripUndefined } from "./proto-utils.js";
 import { type ListParams, type ListResult, type ResourceRef } from "./types.js";
 import { create, type JsonObject } from "@bufbuild/protobuf";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
-import { EnvVarDeclarationSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
+import { EnvVarDeclarationSchema, type EnvVarDeclaration } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
 import { WorkflowSchema, type Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { WorkflowCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/command_pb";
 import { WorkflowTaskKind, BudgetExceededPolicy } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/enum_pb";
 import { WorkflowIdSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/io_pb";
 import { WorkflowQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/query_pb";
 import { type ServerlessWorkflowValidation } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/serverless/validation_pb";
-import { WorkflowSpecSchema, WorkflowDocumentSchema, ExportSchema, FlowControlSchema, WorkflowTaskSchema, WorkflowBudgetSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/spec_pb";
+import { WorkflowSpecSchema, WorkflowDocumentSchema, ExportSchema, FlowControlSchema, WorkflowTaskSchema, WorkflowBudgetSchema, type WorkflowDocument, type Export, type FlowControl, type WorkflowTask, type WorkflowBudget } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/spec_pb";
 import { GetTaskKindRegistryRequestSchema, GetTaskKindRegistryResponseSchema, type GetTaskKindRegistryRequest, type GetTaskKindRegistryResponse } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/task_kind_descriptor_pb";
 import { TaskKindRegistryQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/task_kind_registry_query_pb";
 import { TagWorkflowVersionInputSchema, ListWorkflowVersionsInputSchema, ListWorkflowVersionsResponseSchema, GetWorkflowVersionInputSchema, WorkflowVersionEntrySchema, type TagWorkflowVersionInput, type ListWorkflowVersionsInput, type ListWorkflowVersionsResponse, type GetWorkflowVersionInput, type WorkflowVersionEntry } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/version_pb";
@@ -131,6 +131,14 @@ export class WorkflowClient {
 
 /** Input for creating/updating a Workflow. */
 export interface WorkflowInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -250,6 +258,7 @@ export function buildWorkflowProto(input: WorkflowInput): Workflow {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "Workflow",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -266,3 +275,88 @@ export function buildWorkflowProto(input: WorkflowInput): Workflow {
     })),
   }) as Workflow;
 }
+
+function toWorkflowDocumentInput(msg: WorkflowDocument): WorkflowDocumentInput {
+  return {
+    dsl: msg.dsl || undefined,
+    namespace: msg.namespace ?? "",
+    name: msg.name ?? "",
+    version: msg.version ?? "",
+    description: msg.description || undefined,
+  };
+}
+
+function toExportInput(msg: Export): ExportInput {
+  return {
+    as: msg.as || undefined,
+  };
+}
+
+function toFlowControlInput(msg: FlowControl): FlowControlInput {
+  return {
+    then: msg.then || undefined,
+  };
+}
+
+function toWorkflowTaskInput(msg: WorkflowTask): WorkflowTaskInput {
+  return {
+    name: msg.name || undefined,
+    kind: msg.kind ?? 0,
+    taskConfig: msg.taskConfig ?? {},
+    export: msg.export ? toExportInput(msg.export) : undefined,
+    flow: msg.flow ? toFlowControlInput(msg.flow) : undefined,
+    compensate: msg.compensate?.length ? msg.compensate.map(toWorkflowTaskInput) : undefined,
+  };
+}
+
+function toEnvVarDeclarationInput(msg: EnvVarDeclaration): EnvVarDeclarationInput {
+  return {
+    isSecret: msg.isSecret || undefined,
+    description: msg.description || undefined,
+    optional: msg.optional || undefined,
+  };
+}
+
+function toWorkflowBudgetInput(msg: WorkflowBudget): WorkflowBudgetInput {
+  return {
+    maxCostMicros: msg.maxCostMicros || undefined,
+    maxTotalTokens: msg.maxTotalTokens || undefined,
+    maxDurationSeconds: msg.maxDurationSeconds || undefined,
+    onExceeded: msg.onExceeded || undefined,
+  };
+}
+
+/**
+ * Maps a fetched {@link Workflow} to a complete {@link WorkflowInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toWorkflowUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toWorkflowUpdateInput(resource: Workflow): WorkflowInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(WorkflowSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    // Never carried over: a version message describes the NEXT update.
+    versionMessage: undefined,
+    description: spec.description || undefined,
+    document: toWorkflowDocumentInput(spec.document ?? create(WorkflowDocumentSchema)),
+    tasks: spec.tasks?.length ? spec.tasks.map(toWorkflowTaskInput) : undefined,
+    env: Object.keys(spec.env ?? {}).length > 0 ? Object.fromEntries(Object.entries(spec.env).map(([k, v]) => [k, toEnvVarDeclarationInput(v)])) : undefined,
+    budget: spec.budget ? toWorkflowBudgetInput(spec.budget) : undefined,
+  };
+}