@stigmer/sdk 3.12.5 → 3.12.6

package/src/gen/agentshare.ts

@@ -1,17 +1,17 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toResourceRefInput, toResourceRefInputs } from "./proto-utils.js";
 import { type ResourceRef } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
-import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { RunConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/invocation_pb";
+import { ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { RunConfigSchema, type RunConfig } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/invocation_pb";
 import { AgentShareSchema, type AgentShare } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
 import { AgentShareCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/command_pb";
 import { AgentShareIdSchema, RotateShareLinkInputSchema, GetAgentSharesByAgentRequestSchema, AgentShareListSchema, ListAgentSharesRequestSchema, GetSharedProfileRequestSchema, SharedAgentProfileSchema, type RotateShareLinkInput, type GetAgentSharesByAgentRequest, type AgentShareList, type ListAgentSharesRequest, type GetSharedProfileRequest, type SharedAgentProfile } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
 import { AgentShareQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/query_pb";
-import { AgentShareSpecSchema, AgentShareAudience, AgentShareMessagesSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/spec_pb";
+import { AgentShareSpecSchema, AgentShareAudience, AgentShareMessagesSchema, type AgentShareMessages } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
@@ -96,6 +96,14 @@ export class AgentShareClient {
 
 /** Input for creating/updating a AgentShare. */
 export interface AgentShareInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -123,6 +131,7 @@ export interface RunConfigInput {
   maxCostUsd?: number;
   maxToolRounds?: number;
   serviceTier?: ServiceTier;
+  thinkingMode?: ThinkingMode;
 }
 
 function buildAgentShareMessagesProto(input: AgentShareMessagesInput) {
@@ -139,6 +148,7 @@ function buildRunConfigProto(input: RunConfigInput) {
     maxCostUsd: input.maxCostUsd,
     maxToolRounds: input.maxToolRounds,
     serviceTier: input.serviceTier,
+    thinkingMode: input.thinkingMode,
   }));
 }
 
@@ -151,6 +161,7 @@ export function buildAgentShareProto(input: AgentShareInput): AgentShare {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "AgentShare",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -168,3 +179,56 @@ export function buildAgentShareProto(input: AgentShareInput): AgentShare {
     })),
   }) as AgentShare;
 }
+
+function toAgentShareMessagesInput(msg: AgentShareMessages): AgentShareMessagesInput {
+  return {
+    rateLimited: msg.rateLimited || undefined,
+    unavailable: msg.unavailable || undefined,
+    conversationEnded: msg.conversationEnded || undefined,
+  };
+}
+
+function toRunConfigInput(msg: RunConfig): RunConfigInput {
+  return {
+    modelName: msg.modelName || undefined,
+    maxCostUsd: msg.maxCostUsd || undefined,
+    maxToolRounds: msg.maxToolRounds || undefined,
+    serviceTier: msg.serviceTier || undefined,
+    thinkingMode: msg.thinkingMode || undefined,
+  };
+}
+
+/**
+ * Maps a fetched {@link AgentShare} to a complete {@link AgentShareInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toAgentShareUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toAgentShareUpdateInput(resource: AgentShare): AgentShareInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(AgentShareSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    agentRef: toResourceRefInput(spec.agentRef) ?? { org: "", slug: "" },
+    enabled: spec.enabled || undefined,
+    audience: spec.audience || undefined,
+    allowedOrigins: spec.allowedOrigins?.length ? [...spec.allowedOrigins] : undefined,
+    messages: spec.messages ? toAgentShareMessagesInput(spec.messages) : undefined,
+    environmentRefs: toResourceRefInputs(spec.environmentRefs),
+    runConfig: spec.runConfig ? toRunConfigInput(spec.runConfig) : undefined,
+  };
+}

package/src/gen/apikey.ts

@@ -3,7 +3,7 @@
 import { wrapError } from "./errors.js";
 import { stripUndefined, toTimestamp } from "./proto-utils.js";
 import { create } from "@bufbuild/protobuf";
-import { EmptySchema } from "@bufbuild/protobuf/wkt";
+import { EmptySchema, timestampDate } from "@bufbuild/protobuf/wkt";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
@@ -62,6 +62,14 @@ export class ApiKeyClient {
 
 /** Input for creating/updating a ApiKey. */
 export interface ApiKeyInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -79,6 +87,7 @@ export function buildApiKeyProto(input: ApiKeyInput): ApiKey {
     apiVersion: "iam.stigmer.ai/v1",
     kind: "ApiKey",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -93,3 +102,35 @@ export function buildApiKeyProto(input: ApiKeyInput): ApiKey {
     })),
   }) as ApiKey;
 }
+
+/**
+ * Maps a fetched {@link ApiKey} to a complete {@link ApiKeyInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toApiKeyUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toApiKeyUpdateInput(resource: ApiKey): ApiKeyInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(ApiKeySpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    keyHash: spec.keyHash || undefined,
+    fingerprint: spec.fingerprint || undefined,
+    expiresAt: spec.expiresAt ? timestampDate(spec.expiresAt) : undefined,
+    neverExpires: spec.neverExpires || undefined,
+  };
+}

package/src/gen/artifact.ts

@@ -62,6 +62,14 @@ export class ArtifactClient {
 
 /** Input for creating/updating a Artifact. */
 export interface ArtifactInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -106,6 +114,7 @@ export function buildArtifactProto(input: ArtifactInput): Artifact {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "Artifact",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),

package/src/gen/channelapp.ts

@@ -9,7 +9,7 @@ import { ChannelAppSchema, type ChannelApp } from "@stigmer/protos/ai/stigmer/ag
 import { ChannelAppCommandController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/command_pb";
 import { ListChannelAppsByOrgInputSchema, ChannelAppsSchema, type ListChannelAppsByOrgInput, type ChannelApps } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/io_pb";
 import { ChannelAppQueryController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/query_pb";
-import { ChannelAppSpecSchema, SlackChannelAppConfigSchema, WhatsAppChannelAppConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/spec_pb";
+import { ChannelAppSpecSchema, SlackChannelAppConfigSchema, WhatsAppChannelAppConfigSchema, type SlackChannelAppConfig, type WhatsAppChannelAppConfig } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/spec_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceIdSchema, ApiResourceReferenceSchema, ApiResourceDeleteInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
@@ -74,6 +74,14 @@ export class ChannelAppClient {
 
 /** Input for creating/updating a ChannelApp. */
 export interface ChannelAppInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -127,6 +135,7 @@ export function buildChannelAppProto(input: ChannelAppInput): ChannelApp {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "ChannelApp",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -136,3 +145,50 @@ export function buildChannelAppProto(input: ChannelAppInput): ChannelApp {
     spec,
   }) as ChannelApp;
 }
+
+function toSlackChannelAppConfigInput(msg: SlackChannelAppConfig): SlackChannelAppConfigInput {
+  return {
+    clientId: msg.clientId || undefined,
+    clientSecret: msg.clientSecret || undefined,
+    signingSecret: msg.signingSecret || undefined,
+  };
+}
+
+function toWhatsAppChannelAppConfigInput(msg: WhatsAppChannelAppConfig): WhatsAppChannelAppConfigInput {
+  return {
+    appId: msg.appId || undefined,
+    appSecret: msg.appSecret || undefined,
+    accessToken: msg.accessToken || undefined,
+    verifyToken: msg.verifyToken || undefined,
+  };
+}
+
+/**
+ * Maps a fetched {@link ChannelApp} to a complete {@link ChannelAppInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toChannelAppUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toChannelAppUpdateInput(resource: ChannelApp): ChannelAppInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(ChannelAppSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    slack: spec.providerConfig?.case === "slack" ? toSlackChannelAppConfigInput(spec.providerConfig.value) : undefined,
+    whatsapp: spec.providerConfig?.case === "whatsapp" ? toWhatsAppChannelAppConfigInput(spec.providerConfig.value) : undefined,
+  };
+}

package/src/gen/environment.ts

@@ -1,7 +1,7 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toEnvVarInputMap } from "./proto-utils.js";
 import { type DeleteResourceInput, type ResourceRef, type EnvVarInput } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { createClient, type Client, type Transport } from "@connectrpc/connect";
@@ -98,6 +98,14 @@ export class EnvironmentClient {
 
 /** Input for creating/updating a Environment. */
 export interface EnvironmentInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -117,6 +125,7 @@ export function buildEnvironmentProto(input: EnvironmentInput): Environment {
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "Environment",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -129,3 +138,33 @@ export function buildEnvironmentProto(input: EnvironmentInput): Environment {
     })),
   }) as Environment;
 }
+
+/**
+ * Maps a fetched {@link Environment} to a complete {@link EnvironmentInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toEnvironmentUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toEnvironmentUpdateInput(resource: Environment): EnvironmentInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(EnvironmentSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    description: spec.description || undefined,
+    data: toEnvVarInputMap(spec.data),
+  };
+}

package/src/gen/executioncontext.ts

@@ -68,6 +68,14 @@ export class ExecutionContextClient {
 
 /** Input for creating/updating a ExecutionContext. */
 export interface ExecutionContextInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -87,6 +95,7 @@ export function buildExecutionContextProto(input: ExecutionContextInput): Execut
     apiVersion: "agentic.stigmer.ai/v1",
     kind: "ExecutionContext",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),

package/src/gen/iampolicy.ts

@@ -109,6 +109,14 @@ export class IamPolicyClient {
 
 /** Input for creating/updating a IamPolicy. */
 export interface IamPolicyInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -141,6 +149,7 @@ export function buildIamPolicyProto(input: IamPolicyInput): IamPolicy {
     apiVersion: "iam.stigmer.ai/v1",
     kind: "IamPolicy",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),

package/src/gen/identityaccount.ts

@@ -1,7 +1,7 @@
 // Code generated by stigmer-codegen. DO NOT EDIT.
 
 import { wrapError } from "./errors.js";
-import { stripUndefined } from "./proto-utils.js";
+import { stripUndefined, toResourceRefInput } from "./proto-utils.js";
 import { type ResourceRef } from "./types.js";
 import { create } from "@bufbuild/protobuf";
 import { EmptySchema } from "@bufbuild/protobuf/wkt";
@@ -15,7 +15,7 @@ import { IdentityAccountCommandController } from "@stigmer/protos/ai/stigmer/iam
 import { IdentityAccountProvisioningMode } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/enum_pb";
 import { IdentityAccountIdSchema, CreateFederatedAccountInputSchema, UpdateFederatedAccountInputSchema, DeprovisionFederatedAccountInputSchema, IdentityAccountEmailSchema, IdpIdSchema, ExternalSubLookupSchema, type CreateFederatedAccountInput, type UpdateFederatedAccountInput, type DeprovisionFederatedAccountInput, type IdentityAccountEmail, type ExternalSubLookup } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/io_pb";
 import { IdentityAccountQueryController } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/query_pb";
-import { IdentityAccountSpecSchema, IdentityAccountPreferencesSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
+import { IdentityAccountSpecSchema, IdentityAccountPreferencesSchema, type IdentityAccountPreferences } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/spec_pb";
 
 /** Provides operations on identityaccount resources. */
 export class IdentityAccountClient {
@@ -108,6 +108,14 @@ export class IdentityAccountClient {
 
 /** Input for creating/updating a IdentityAccount. */
 export interface IdentityAccountInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -148,6 +156,7 @@ export function buildIdentityAccountProto(input: IdentityAccountInput): Identity
     apiVersion: "iam.stigmer.ai/v1",
     kind: "IdentityAccount",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -167,3 +176,49 @@ export function buildIdentityAccountProto(input: IdentityAccountInput): Identity
     })),
   }) as IdentityAccount;
 }
+
+function toIdentityAccountPreferencesInput(msg: IdentityAccountPreferences): IdentityAccountPreferencesInput {
+  return {
+    standingContext: msg.standingContext || undefined,
+    defaultHarness: msg.defaultHarness || undefined,
+    defaultNativeModel: msg.defaultNativeModel || undefined,
+    defaultCursorModel: msg.defaultCursorModel || undefined,
+  };
+}
+
+/**
+ * Maps a fetched {@link IdentityAccount} to a complete {@link IdentityAccountInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toIdentityAccountUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toIdentityAccountUpdateInput(resource: IdentityAccount): IdentityAccountInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(IdentityAccountSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    idpId: spec.idpId ?? "",
+    email: spec.email || undefined,
+    firstName: spec.firstName || undefined,
+    lastName: spec.lastName || undefined,
+    pictureUrl: spec.pictureUrl || undefined,
+    isMachineAccount: spec.isMachineAccount || undefined,
+    provisioningMode: spec.provisioningMode || undefined,
+    identityProviderRef: toResourceRefInput(spec.identityProviderRef),
+    preferences: spec.preferences ? toIdentityAccountPreferencesInput(spec.preferences) : undefined,
+  };
+}

package/src/gen/identityprovider.ts

@@ -81,6 +81,14 @@ export class IdentityProviderClient {
 
 /** Input for creating/updating a IdentityProvider. */
 export interface IdentityProviderInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -105,6 +113,7 @@ export function buildIdentityProviderProto(input: IdentityProviderInput): Identi
     apiVersion: "iam.stigmer.ai/v1",
     kind: "IdentityProvider",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),
@@ -127,3 +136,43 @@ export function buildIdentityProviderProto(input: IdentityProviderInput): Identi
     })),
   }) as IdentityProvider;
 }
+
+/**
+ * Maps a fetched {@link IdentityProvider} to a complete {@link IdentityProviderInput} for `update()`.
+ *
+ * The update RPC replaces the ENTIRE spec — spread this mapper's output
+ * and override only the fields you edit (spread nested objects the same
+ * way):
+ *
+ *   await client.update({ ...toIdentityProviderUpdateInput(res), description: next });
+ *
+ * Proto3 defaults normalize to `undefined`; resource references keep
+ * `version` (pinned refs) and `kind`.
+ */
+export function toIdentityProviderUpdateInput(resource: IdentityProvider): IdentityProviderInput {
+  const meta = resource.metadata;
+  const spec = resource.spec ?? create(IdentityProviderSpecSchema);
+  return {
+    // Exact update addressing (id-first in the update pipeline) — for
+    // platform-scoped (org-less) kinds the org+slug fallback cannot
+    // match, so the id is the ONLY working address.
+    id: meta?.id || undefined,
+    name: meta?.name ?? "",
+    slug: meta?.slug || undefined,
+    org: meta?.org ?? "",
+    labels: meta?.labels && Object.keys(meta.labels).length > 0 ? { ...meta.labels } : undefined,
+    visibility: meta?.visibility || undefined,
+    displayName: spec.displayName || undefined,
+    jwksUri: spec.jwksUri || undefined,
+    allowedIssuers: spec.allowedIssuers?.length ? [...spec.allowedIssuers] : undefined,
+    expectedAudience: spec.expectedAudience || undefined,
+    rateLimitBudget: spec.rateLimitBudget || undefined,
+    userinfoEndpoint: spec.userinfoEndpoint || undefined,
+    isSsoProvider: spec.isSsoProvider || undefined,
+    oidcClientId: spec.oidcClientId || undefined,
+    autoProvisionAccounts: spec.autoProvisionAccounts || undefined,
+    autoGrantOnOrg: spec.autoGrantOnOrg || undefined,
+    autoGrantRole: spec.autoGrantRole || undefined,
+    tenantOrgClaim: spec.tenantOrgClaim || undefined,
+  };
+}

package/src/gen/invitation.ts

@@ -62,6 +62,14 @@ export class InvitationClient {
 
 /** Input for creating/updating a Invitation. */
 export interface InvitationInput {
+  /**
+   * The resource's `metadata.id`, for exact update addressing when set
+   * from a loaded resource. Required for updates to platform-scoped
+   * (org-less) kinds, where the org+slug fallback cannot match. On
+   * create, the cloud server stamps its own id regardless; the OSS
+   * server honors a caller-supplied id (existing apply semantics).
+   */
+  id?: string;
   name: string;
   slug?: string;
   org: string;
@@ -79,6 +87,7 @@ export function buildInvitationProto(input: InvitationInput): Invitation {
     apiVersion: "iam.stigmer.ai/v1",
     kind: "Invitation",
     metadata: Object.assign(create(ApiResourceMetadataSchema), {
+      ...(input.id && { id: input.id }),
       name: input.name,
       org: input.org,
       ...(input.slug && { slug: input.slug }),