@autohq/cli 0.1.129 → 0.1.130

package/dist/index.js

@@ -16052,7 +16052,7 @@ var init_zod = __esm({
 });
 
 // ../../packages/schemas/src/ids.ts
-var OpaqueIdSchema, ProfileIdSchema, EnvironmentIdSchema, ConnectionIdSchema, ExternalAccountIdSchema, OrganizationIdSchema, ProjectIdSchema, ProviderGrantIdSchema, ServiceAccountIdSchema, SessionIdSchema, SessionRunIdSchema, SessionRunCommandIdSchema, RuntimeIdSchema, RuntimeBridgeLeaseIdSchema, EnvironmentSetupSnapshotIdSchema, ToolIdSchema, UserIdSchema;
+var OpaqueIdSchema, ProfileIdSchema, EnvironmentIdSchema, IdentityIdSchema, ConnectionIdSchema, ExternalAccountIdSchema, OrganizationIdSchema, ProjectIdSchema, ProviderGrantIdSchema, ServiceAccountIdSchema, SessionIdSchema, SessionRunIdSchema, SessionRunCommandIdSchema, RuntimeIdSchema, RuntimeBridgeLeaseIdSchema, EnvironmentSetupSnapshotIdSchema, ToolIdSchema, UserIdSchema;
 var init_ids = __esm({
   "../../packages/schemas/src/ids.ts"() {
     "use strict";
@@ -16060,6 +16060,7 @@ var init_ids = __esm({
     OpaqueIdSchema = external_exports.string().trim().min(1);
     ProfileIdSchema = OpaqueIdSchema.brand();
     EnvironmentIdSchema = OpaqueIdSchema.brand();
+    IdentityIdSchema = OpaqueIdSchema.brand();
     ConnectionIdSchema = OpaqueIdSchema.brand();
     ExternalAccountIdSchema = OpaqueIdSchema.brand();
     OrganizationIdSchema = OpaqueIdSchema.brand();
@@ -17431,193 +17432,6 @@ var init_github_mcp_catalog = __esm({
   }
 });
 
-// ../../packages/schemas/src/secrets.ts
-var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretSetRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema;
-var init_secrets = __esm({
-  "../../packages/schemas/src/secrets.ts"() {
-    "use strict";
-    init_zod();
-    init_resources();
-    SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
-    SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
-    SecretCiphertextFieldSchema = external_exports.string().trim().min(1).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
-    SecretAesGcmIvSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{16}$/);
-    SecretAesGcmAuthTagSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{22}==$/);
-    SecretEnvValueSchema = external_exports.union([
-      external_exports.string(),
-      external_exports.object({
-        $secret: ResourceNameSchema,
-        optional: external_exports.boolean().optional()
-      })
-    ]);
-    SecretEnvSchema = external_exports.record(
-      SecretEnvNameSchema,
-      SecretEnvValueSchema
-    );
-    EncryptedSecretValueSchema = external_exports.object({
-      keyVersion: external_exports.string().trim().min(1),
-      algorithm: external_exports.literal(SECRET_ENCRYPTION_ALGORITHM),
-      ciphertext: SecretCiphertextFieldSchema,
-      valueIv: SecretAesGcmIvSchema,
-      valueAuthTag: SecretAesGcmAuthTagSchema,
-      encryptedDek: SecretCiphertextFieldSchema,
-      dekIv: SecretAesGcmIvSchema,
-      dekAuthTag: SecretAesGcmAuthTagSchema
-    });
-    SecretSetRequestSchema = external_exports.object({
-      value: external_exports.string()
-    });
-    SecretMetadataSchema = external_exports.object({
-      id: external_exports.string().trim().min(1),
-      organizationId: external_exports.string().trim().min(1),
-      projectId: external_exports.string().trim().min(1).nullable(),
-      name: ResourceNameSchema,
-      createdAt: external_exports.string().datetime(),
-      updatedAt: external_exports.string().datetime()
-    });
-    SecretSetResponseSchema = external_exports.object({
-      secret: SecretMetadataSchema
-    });
-    SecretListResponseSchema = external_exports.object({
-      secrets: external_exports.array(SecretMetadataSchema)
-    });
-    SecretDeleteResponseSchema = external_exports.object({
-      secret: SecretMetadataSchema
-    });
-  }
-});
-
-// ../../packages/schemas/src/environments.ts
-function environmentSetupSchema(cachePathSchema) {
-  return external_exports.object({
-    name: ResourceNameSchema,
-    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
-    cache: external_exports.object({
-      key: ResourceNameSchema.optional(),
-      files: external_exports.array(
-        external_exports.string().trim().refine(isSafeRelativePath, {
-          message: "Expected a relative path without traversal"
-        })
-      ).default([]),
-      paths: external_exports.array(cachePathSchema).default([])
-    }).strict().default({ files: [], paths: [] })
-  }).strict();
-}
-function environmentSpecSchema(setupSchema) {
-  return external_exports.object({
-    image: EnvironmentImageSchema,
-    env: SecretEnvSchema.default({}),
-    resources: EnvironmentResourcesSchema.optional(),
-    steps: external_exports.array(external_exports.string()).default([]),
-    setup: external_exports.array(setupSchema).default([]),
-    setupCache: EnvironmentSetupCacheSchema.optional()
-  }).strict();
-}
-function isSafeSandboxUserHomePath(value, options = {}) {
-  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
-    (home) => isSafePathUnderHome(value, home)
-  );
-}
-function isSafePathUnderHome(value, home) {
-  const prefix = `${home}/`;
-  if (!value.startsWith(prefix)) {
-    return false;
-  }
-  const relative = value.slice(prefix.length);
-  return relative.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSafeRelativePath(value) {
-  if (!value || value.startsWith("/")) {
-    return false;
-  }
-  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSetupCacheTtl(value) {
-  return /^[1-9][0-9]*(s|m|h|d)$/.test(value);
-}
-var RESOURCE_KIND_ENVIRONMENT, CURRENT_SANDBOX_USER_HOME, LEGACY_SANDBOX_USER_HOMES, STORED_SANDBOX_USER_HOMES, EnvironmentSetupCachePathSchema, StoredEnvironmentSetupCachePathSchema, EnvironmentImageSchema, EnvironmentSetupSchema, EnvironmentApplySetupSchema, EnvironmentSetupCacheSchema, EnvironmentResourcesSchema, EnvironmentSpecSchema, EnvironmentApplySpecSchema, EnvironmentResourceSchema, EnvironmentApplyRequestSchema;
-var init_environments = __esm({
-  "../../packages/schemas/src/environments.ts"() {
-    "use strict";
-    init_zod();
-    init_resources();
-    init_secrets();
-    RESOURCE_KIND_ENVIRONMENT = "environment";
-    CURRENT_SANDBOX_USER_HOME = "/home/user";
-    LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
-    STORED_SANDBOX_USER_HOMES = [
-      CURRENT_SANDBOX_USER_HOME,
-      ...LEGACY_SANDBOX_USER_HOMES
-    ];
-    EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value) => isSafeSandboxUserHomePath(value), {
-      message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-    });
-    StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
-      (value) => isSafeSandboxUserHomePath(value, {
-        allowedHomes: STORED_SANDBOX_USER_HOMES
-      }),
-      {
-        message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-      }
-    );
-    EnvironmentImageSchema = external_exports.object({
-      kind: external_exports.literal("preset"),
-      name: ResourceNameSchema
-    }).strict();
-    EnvironmentSetupSchema = environmentSetupSchema(
-      StoredEnvironmentSetupCachePathSchema
-    );
-    EnvironmentApplySetupSchema = environmentSetupSchema(
-      EnvironmentSetupCachePathSchema
-    );
-    EnvironmentSetupCacheSchema = external_exports.object({
-      ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
-        message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
-      })
-    }).strict();
-    EnvironmentResourcesSchema = external_exports.object({
-      cpuCount: external_exports.number().int().min(1).optional(),
-      memoryMB: external_exports.number().int().min(128).optional()
-    }).strict().refine(
-      (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
-      {
-        message: "Expected at least one runtime resource setting"
-      }
-    );
-    EnvironmentSpecSchema = environmentSpecSchema(
-      EnvironmentSetupSchema
-    );
-    EnvironmentApplySpecSchema = environmentSpecSchema(
-      EnvironmentApplySetupSchema
-    );
-    EnvironmentResourceSchema = resourceEnvelopeSchema(
-      EnvironmentSpecSchema
-    );
-    EnvironmentApplyRequestSchema = resourceApplySchema(
-      EnvironmentApplySpecSchema
-    );
-  }
-});
-
-// ../../packages/schemas/src/mcp.ts
-var McpToolCallMessageSchema, McpJsonRpcMessageSchema, McpPostBodySchema;
-var init_mcp = __esm({
-  "../../packages/schemas/src/mcp.ts"() {
-    "use strict";
-    init_zod();
-    McpToolCallMessageSchema = external_exports.object({
-      method: external_exports.literal("tools/call"),
-      params: external_exports.object({
-        name: external_exports.string().trim().min(1)
-      })
-    });
-    McpJsonRpcMessageSchema = external_exports.object({
-      method: external_exports.string().optional()
-    }).passthrough();
-    McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
-  }
-});
-
 // ../../packages/schemas/src/mounts.ts
 var AbsoluteMountPathSchema, GITHUB_MOUNT_CAPABILITY_LEVELS, GithubMountCapabilityLevelSchema, GITHUB_MOUNT_MERGE_CAPABILITY_LEVELS, GithubMountMergeCapabilityLevelSchema, DEFAULT_GITHUB_MOUNT_CAPABILITIES, GitMountAuthSchema, GitMountSchema, SessionMountSchema;
 var init_mounts = __esm({
@@ -17696,43 +17510,58 @@ var init_mounts = __esm({
   }
 });
 
-// ../../packages/schemas/src/project-service-accounts.ts
-var ProjectServiceAccountSchema, ProjectServiceAccountCreateRequestSchema, ProjectServiceAccountUpdateRequestSchema, ProjectServiceAccountTokenResponseSchema, ProjectServiceAccountUpdateResponseSchema, ProjectServiceAccountRemoveResponseSchema, ProjectServiceAccountListResponseSchema;
-var init_project_service_accounts = __esm({
-  "../../packages/schemas/src/project-service-accounts.ts"() {
+// ../../packages/schemas/src/secrets.ts
+var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretSetRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema;
+var init_secrets = __esm({
+  "../../packages/schemas/src/secrets.ts"() {
     "use strict";
     init_zod();
-    init_auth();
-    init_ids();
     init_resources();
-    ProjectServiceAccountSchema = external_exports.object({
-      id: ServiceAccountIdSchema,
-      organizationId: OrganizationIdSchema,
-      projectId: ProjectIdSchema,
-      name: ResourceNameSchema,
-      scopes: external_exports.array(AuthScopeSchema),
-      createdAt: external_exports.string().datetime()
-    });
-    ProjectServiceAccountCreateRequestSchema = external_exports.object({
-      name: ResourceNameSchema,
-      scopes: external_exports.array(AuthScopeSchema).min(1)
+    SECRET_ENCRYPTION_ALGORITHM = "AES-256-GCM";
+    SecretEnvNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+    SecretCiphertextFieldSchema = external_exports.string().trim().min(1).regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/);
+    SecretAesGcmIvSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{16}$/);
+    SecretAesGcmAuthTagSchema = external_exports.string().trim().regex(/^[A-Za-z0-9+/]{22}==$/);
+    SecretEnvValueSchema = external_exports.union([
+      external_exports.string(),
+      external_exports.object({
+        $secret: ResourceNameSchema,
+        optional: external_exports.boolean().optional()
+      })
+    ]);
+    SecretEnvSchema = external_exports.record(
+      SecretEnvNameSchema,
+      SecretEnvValueSchema
+    );
+    EncryptedSecretValueSchema = external_exports.object({
+      keyVersion: external_exports.string().trim().min(1),
+      algorithm: external_exports.literal(SECRET_ENCRYPTION_ALGORITHM),
+      ciphertext: SecretCiphertextFieldSchema,
+      valueIv: SecretAesGcmIvSchema,
+      valueAuthTag: SecretAesGcmAuthTagSchema,
+      encryptedDek: SecretCiphertextFieldSchema,
+      dekIv: SecretAesGcmIvSchema,
+      dekAuthTag: SecretAesGcmAuthTagSchema
     });
-    ProjectServiceAccountUpdateRequestSchema = external_exports.object({
-      scopes: external_exports.array(AuthScopeSchema).min(1)
+    SecretSetRequestSchema = external_exports.object({
+      value: external_exports.string()
     });
-    ProjectServiceAccountTokenResponseSchema = external_exports.object({
-      serviceAccount: ProjectServiceAccountSchema,
-      token: external_exports.string().min(1)
+    SecretMetadataSchema = external_exports.object({
+      id: external_exports.string().trim().min(1),
+      organizationId: external_exports.string().trim().min(1),
+      projectId: external_exports.string().trim().min(1).nullable(),
+      name: ResourceNameSchema,
+      createdAt: external_exports.string().datetime(),
+      updatedAt: external_exports.string().datetime()
     });
-    ProjectServiceAccountUpdateResponseSchema = external_exports.object({
-      serviceAccount: ProjectServiceAccountSchema
+    SecretSetResponseSchema = external_exports.object({
+      secret: SecretMetadataSchema
     });
-    ProjectServiceAccountRemoveResponseSchema = external_exports.object({
-      serviceAccount: ProjectServiceAccountSchema,
-      removed: external_exports.literal(true)
+    SecretListResponseSchema = external_exports.object({
+      secrets: external_exports.array(SecretMetadataSchema)
     });
-    ProjectServiceAccountListResponseSchema = external_exports.object({
-      serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
+    SecretDeleteResponseSchema = external_exports.object({
+      secret: SecretMetadataSchema
     });
   }
 });
@@ -18436,13 +18265,13 @@ var init_sessions = __esm({
         }
       ).optional()
     }).strict().refine((identity2) => Object.keys(identity2).length > 0, {
-      message: "Session identity requires at least one field"
+      message: "Identity requires at least one field"
     });
     SessionSpecFieldsSchema = external_exports.object({
       harness: external_exports.enum(SESSION_HARNESSES).optional(),
       systemPrompt: external_exports.string().trim().min(1).max(1e5).optional(),
       environment: ResourceNameSchema.optional(),
-      identity: SessionIdentitySchema.optional(),
+      identity: external_exports.union([ResourceNameSchema, SessionIdentitySchema]).optional(),
       initialPrompt: external_exports.string().trim().min(1).max(2e4).optional(),
       env: SecretEnvSchema.default({}),
       mounts: external_exports.array(SessionMountSchema).default([]),
@@ -18578,13 +18407,200 @@ var init_sessions = __esm({
   }
 });
 
+// ../../packages/schemas/src/identities.ts
+var RESOURCE_KIND_IDENTITY, IdentitySpecSchema, IdentityResourceSchema, IdentityApplyRequestSchema;
+var init_identities = __esm({
+  "../../packages/schemas/src/identities.ts"() {
+    "use strict";
+    init_resources();
+    init_sessions();
+    RESOURCE_KIND_IDENTITY = "identity";
+    IdentitySpecSchema = SessionIdentitySchema;
+    IdentityResourceSchema = resourceEnvelopeSchema(IdentitySpecSchema);
+    IdentityApplyRequestSchema = resourceApplySchema(IdentitySpecSchema);
+  }
+});
+
+// ../../packages/schemas/src/environments.ts
+function environmentSetupSchema(cachePathSchema) {
+  return external_exports.object({
+    name: ResourceNameSchema,
+    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
+    cache: external_exports.object({
+      key: ResourceNameSchema.optional(),
+      files: external_exports.array(
+        external_exports.string().trim().refine(isSafeRelativePath, {
+          message: "Expected a relative path without traversal"
+        })
+      ).default([]),
+      paths: external_exports.array(cachePathSchema).default([])
+    }).strict().default({ files: [], paths: [] })
+  }).strict();
+}
+function environmentSpecSchema(setupSchema) {
+  return external_exports.object({
+    image: EnvironmentImageSchema,
+    env: SecretEnvSchema.default({}),
+    resources: EnvironmentResourcesSchema.optional(),
+    steps: external_exports.array(external_exports.string()).default([]),
+    setup: external_exports.array(setupSchema).default([]),
+    setupCache: EnvironmentSetupCacheSchema.optional()
+  }).strict();
+}
+function isSafeSandboxUserHomePath(value, options = {}) {
+  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
+    (home) => isSafePathUnderHome(value, home)
+  );
+}
+function isSafePathUnderHome(value, home) {
+  const prefix = `${home}/`;
+  if (!value.startsWith(prefix)) {
+    return false;
+  }
+  const relative = value.slice(prefix.length);
+  return relative.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSafeRelativePath(value) {
+  if (!value || value.startsWith("/")) {
+    return false;
+  }
+  return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSetupCacheTtl(value) {
+  return /^[1-9][0-9]*(s|m|h|d)$/.test(value);
+}
+var RESOURCE_KIND_ENVIRONMENT, CURRENT_SANDBOX_USER_HOME, LEGACY_SANDBOX_USER_HOMES, STORED_SANDBOX_USER_HOMES, EnvironmentSetupCachePathSchema, StoredEnvironmentSetupCachePathSchema, EnvironmentImageSchema, EnvironmentSetupSchema, EnvironmentApplySetupSchema, EnvironmentSetupCacheSchema, EnvironmentResourcesSchema, EnvironmentSpecSchema, EnvironmentApplySpecSchema, EnvironmentResourceSchema, EnvironmentApplyRequestSchema;
+var init_environments = __esm({
+  "../../packages/schemas/src/environments.ts"() {
+    "use strict";
+    init_zod();
+    init_resources();
+    init_secrets();
+    RESOURCE_KIND_ENVIRONMENT = "environment";
+    CURRENT_SANDBOX_USER_HOME = "/home/user";
+    LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
+    STORED_SANDBOX_USER_HOMES = [
+      CURRENT_SANDBOX_USER_HOME,
+      ...LEGACY_SANDBOX_USER_HOMES
+    ];
+    EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value) => isSafeSandboxUserHomePath(value), {
+      message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+    });
+    StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
+      (value) => isSafeSandboxUserHomePath(value, {
+        allowedHomes: STORED_SANDBOX_USER_HOMES
+      }),
+      {
+        message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+      }
+    );
+    EnvironmentImageSchema = external_exports.object({
+      kind: external_exports.literal("preset"),
+      name: ResourceNameSchema
+    }).strict();
+    EnvironmentSetupSchema = environmentSetupSchema(
+      StoredEnvironmentSetupCachePathSchema
+    );
+    EnvironmentApplySetupSchema = environmentSetupSchema(
+      EnvironmentSetupCachePathSchema
+    );
+    EnvironmentSetupCacheSchema = external_exports.object({
+      ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
+        message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
+      })
+    }).strict();
+    EnvironmentResourcesSchema = external_exports.object({
+      cpuCount: external_exports.number().int().min(1).optional(),
+      memoryMB: external_exports.number().int().min(128).optional()
+    }).strict().refine(
+      (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
+      {
+        message: "Expected at least one runtime resource setting"
+      }
+    );
+    EnvironmentSpecSchema = environmentSpecSchema(
+      EnvironmentSetupSchema
+    );
+    EnvironmentApplySpecSchema = environmentSpecSchema(
+      EnvironmentApplySetupSchema
+    );
+    EnvironmentResourceSchema = resourceEnvelopeSchema(
+      EnvironmentSpecSchema
+    );
+    EnvironmentApplyRequestSchema = resourceApplySchema(
+      EnvironmentApplySpecSchema
+    );
+  }
+});
+
+// ../../packages/schemas/src/mcp.ts
+var McpToolCallMessageSchema, McpJsonRpcMessageSchema, McpPostBodySchema;
+var init_mcp = __esm({
+  "../../packages/schemas/src/mcp.ts"() {
+    "use strict";
+    init_zod();
+    McpToolCallMessageSchema = external_exports.object({
+      method: external_exports.literal("tools/call"),
+      params: external_exports.object({
+        name: external_exports.string().trim().min(1)
+      })
+    });
+    McpJsonRpcMessageSchema = external_exports.object({
+      method: external_exports.string().optional()
+    }).passthrough();
+    McpPostBodySchema = external_exports.union([McpJsonRpcMessageSchema, external_exports.array(McpJsonRpcMessageSchema)]).transform((body) => Array.isArray(body) ? body : [body]);
+  }
+});
+
+// ../../packages/schemas/src/project-service-accounts.ts
+var ProjectServiceAccountSchema, ProjectServiceAccountCreateRequestSchema, ProjectServiceAccountUpdateRequestSchema, ProjectServiceAccountTokenResponseSchema, ProjectServiceAccountUpdateResponseSchema, ProjectServiceAccountRemoveResponseSchema, ProjectServiceAccountListResponseSchema;
+var init_project_service_accounts = __esm({
+  "../../packages/schemas/src/project-service-accounts.ts"() {
+    "use strict";
+    init_zod();
+    init_auth();
+    init_ids();
+    init_resources();
+    ProjectServiceAccountSchema = external_exports.object({
+      id: ServiceAccountIdSchema,
+      organizationId: OrganizationIdSchema,
+      projectId: ProjectIdSchema,
+      name: ResourceNameSchema,
+      scopes: external_exports.array(AuthScopeSchema),
+      createdAt: external_exports.string().datetime()
+    });
+    ProjectServiceAccountCreateRequestSchema = external_exports.object({
+      name: ResourceNameSchema,
+      scopes: external_exports.array(AuthScopeSchema).min(1)
+    });
+    ProjectServiceAccountUpdateRequestSchema = external_exports.object({
+      scopes: external_exports.array(AuthScopeSchema).min(1)
+    });
+    ProjectServiceAccountTokenResponseSchema = external_exports.object({
+      serviceAccount: ProjectServiceAccountSchema,
+      token: external_exports.string().min(1)
+    });
+    ProjectServiceAccountUpdateResponseSchema = external_exports.object({
+      serviceAccount: ProjectServiceAccountSchema
+    });
+    ProjectServiceAccountRemoveResponseSchema = external_exports.object({
+      serviceAccount: ProjectServiceAccountSchema,
+      removed: external_exports.literal(true)
+    });
+    ProjectServiceAccountListResponseSchema = external_exports.object({
+      serviceAccounts: external_exports.array(ProjectServiceAccountSchema)
+    });
+  }
+});
+
 // ../../packages/schemas/src/project-resources.ts
-var EnvironmentApplyDocumentSchema, ToolApplyDocumentSchema, SessionApplyDocumentSchema, ProjectApplyResourceSchema, PROJECT_RESOURCE_APPLY_ORDER, PROJECT_RESOURCE_KINDS, ProjectDeleteResourceSchema, AVATAR_ASSET_CONTENT_TYPES, MAX_AVATAR_ASSET_BASE64_LENGTH, ProjectApplyAssetSchema, ProjectApplyAssetsSchema, AvatarAssetUploadRequestSchema, AvatarAssetUploadResponseSchema, ProjectApplyRequestSchema, ProjectApplySystemConfigSchema, ProjectAppliedResourceSchema, ProjectApplyDiagnosticSchema, ProjectApplyResponseSchema;
+var EnvironmentApplyDocumentSchema, IdentityApplyDocumentSchema, ToolApplyDocumentSchema, SessionApplyDocumentSchema, ProjectApplyResourceSchema, PROJECT_RESOURCE_APPLY_ORDER, PROJECT_RESOURCE_KINDS, ProjectDeleteResourceSchema, AVATAR_ASSET_CONTENT_TYPES, MAX_AVATAR_ASSET_BASE64_LENGTH, ProjectApplyAssetSchema, ProjectApplyAssetsSchema, AvatarAssetUploadRequestSchema, AvatarAssetUploadResponseSchema, ProjectApplyRequestSchema, ProjectApplySystemConfigSchema, ProjectAppliedResourceSchema, ProjectApplyDiagnosticSchema, ProjectApplyResponseSchema;
 var init_project_resources = __esm({
   "../../packages/schemas/src/project-resources.ts"() {
     "use strict";
     init_zod();
     init_environments();
+    init_identities();
     init_resources();
     init_sessions();
     init_tools();
@@ -18592,6 +18608,10 @@ var init_project_resources = __esm({
       RESOURCE_KIND_ENVIRONMENT,
       EnvironmentApplyRequestSchema.shape.spec
     );
+    IdentityApplyDocumentSchema = resourceApplyDocumentSchema(
+      RESOURCE_KIND_IDENTITY,
+      IdentityApplyRequestSchema.shape.spec
+    );
     ToolApplyDocumentSchema = resourceApplyDocumentSchema(
       RESOURCE_KIND_TOOL,
       ToolApplyRequestSchema.shape.spec
@@ -18602,11 +18622,13 @@ var init_project_resources = __esm({
     );
     ProjectApplyResourceSchema = external_exports.discriminatedUnion("kind", [
       EnvironmentApplyDocumentSchema,
+      IdentityApplyDocumentSchema,
       ToolApplyDocumentSchema,
       SessionApplyDocumentSchema
     ]);
     PROJECT_RESOURCE_APPLY_ORDER = [
       RESOURCE_KIND_ENVIRONMENT,
+      RESOURCE_KIND_IDENTITY,
       RESOURCE_KIND_TOOL,
       RESOURCE_KIND_SESSION
     ];
@@ -18652,6 +18674,7 @@ var init_project_resources = __esm({
     });
     ProjectAppliedResourceSchema = external_exports.union([
       EnvironmentResourceSchema,
+      IdentityResourceSchema,
       ToolResourceSchema,
       SessionResourceSchema
     ]);
@@ -18663,6 +18686,7 @@ var init_project_resources = __esm({
       action: external_exports.enum(["create", "update", "unchanged"]),
       kind: external_exports.enum([
         RESOURCE_KIND_ENVIRONMENT,
+        RESOURCE_KIND_IDENTITY,
         RESOURCE_KIND_TOOL,
         RESOURCE_KIND_SESSION
       ]),
@@ -18678,6 +18702,7 @@ var init_project_resources = __esm({
           action: external_exports.enum(["create", "update", "unchanged", "archive"]),
           kind: external_exports.enum([
             RESOURCE_KIND_ENVIRONMENT,
+            RESOURCE_KIND_IDENTITY,
             RESOURCE_KIND_TOOL,
             RESOURCE_KIND_SESSION
           ]),
@@ -18689,6 +18714,7 @@ var init_project_resources = __esm({
         external_exports.object({
           kind: external_exports.enum([
             RESOURCE_KIND_ENVIRONMENT,
+            RESOURCE_KIND_IDENTITY,
             RESOURCE_KIND_TOOL,
             RESOURCE_KIND_SESSION
           ]),
@@ -19416,6 +19442,7 @@ var init_src = __esm({
     init_connections();
     init_github_credentials();
     init_github_mcp_catalog();
+    init_identities();
     init_ids();
     init_environments();
     init_mcp();
@@ -19631,6 +19658,13 @@ function createResourceApi(context) {
     path: "/tools",
     applyResponseSchema: ToolResourceSchema
   });
+  const identities = projectResource(
+    context,
+    {
+      path: "/identities",
+      applyResponseSchema: IdentityResourceSchema
+    }
+  );
   return {
     applyEnvironmentResource: environments.apply,
     hasAvatarAsset: (request, options) => hasAvatarAsset(context, request, options ?? {}),
@@ -19645,6 +19679,7 @@ function createResourceApi(context) {
     createProjectServiceAccount: (request, options) => createProjectServiceAccount(context, request, options ?? {}),
     deleteProjectResource: (request, options) => deleteProjectResource(context, request, options ?? {}),
     listEnvironments: environments.list,
+    listIdentities: identities.list,
     listProjectServiceAccounts: (options) => listProjectServiceAccounts(context, options ?? {}),
     listSessions: sessions.list,
     listTools: tools.list,
@@ -21190,7 +21225,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.129",
+      version: "0.1.130",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -21437,28 +21472,39 @@ async function uploadAvatarAsset2(client, asset, apiBaseUrl) {
   }
 }
 function stampAvatarSha256(resource, assets) {
-  if (resource.kind !== "session") {
-    return resource;
-  }
-  const identity2 = resource.spec.identity;
-  const avatar = identity2?.avatar;
-  if (!identity2 || !avatar) {
-    return resource;
-  }
-  const asset = assets[avatar.asset];
-  if (!asset) {
-    return resource;
-  }
-  return {
-    ...resource,
-    spec: {
-      ...resource.spec,
-      identity: {
-        ...identity2,
+  if (resource.kind === "identity") {
+    const avatar = resource.spec.avatar;
+    const asset = avatar ? assets[avatar.asset] : void 0;
+    if (!avatar || !asset) {
+      return resource;
+    }
+    return {
+      ...resource,
+      spec: {
+        ...resource.spec,
         avatar: { asset: avatar.asset, sha256: asset.sha256 }
       }
+    };
+  }
+  if (resource.kind === "session" && typeof resource.spec.identity === "object" && resource.spec.identity !== null && !Array.isArray(resource.spec.identity)) {
+    const identity2 = resource.spec.identity;
+    const avatar = identity2.avatar;
+    const asset = avatar ? assets[avatar.asset] : void 0;
+    if (!avatar || !asset) {
+      return resource;
     }
-  };
+    return {
+      ...resource,
+      spec: {
+        ...resource.spec,
+        identity: {
+          ...identity2,
+          avatar: { asset: avatar.asset, sha256: asset.sha256 }
+        }
+      }
+    };
+  }
+  return resource;
 }
 function formatMegabytes(bytes) {
   return (bytes / (1024 * 1024)).toFixed(1);
@@ -21624,26 +21670,23 @@ function readApplyDocument(document) {
 function readApplyAssets(resources, projectRoot) {
   const assets = {};
   for (const resource of resources) {
-    if (resource.kind !== RESOURCE_KIND_SESSION) {
-      continue;
-    }
-    const avatarAsset = resource.spec.identity?.avatar?.asset;
-    if (!avatarAsset || assets[avatarAsset]) {
+    const target = avatarAssetTarget(resource);
+    if (!target || assets[target.asset]) {
       continue;
     }
     const resolvedPath = validateSessionAvatarAsset({
-      asset: avatarAsset,
-      resourceName: resource.metadata.name,
+      asset: target.asset,
+      resourceName: target.resourceName,
       projectRoot
     });
     const bytes = readFileSync3(resolvedPath);
     const dimensionsProblem = avatarAssetDimensionsProblem(bytes);
     if (dimensionsProblem) {
       throw new Error(
-        `Invalid session identity avatar asset for "${resource.metadata.name}": ${dimensionsProblem}`
+        `Invalid identity avatar asset for "${target.resourceName}": ${dimensionsProblem}`
       );
     }
-    assets[avatarAsset] = {
+    assets[target.asset] = {
       sha256: createHash3("sha256").update(bytes).digest("hex"),
       contentType: extname(resolvedPath).toLowerCase() === ".png" ? "image/png" : "image/jpeg",
       dataBase64: bytes.toString("base64")
@@ -21651,16 +21694,27 @@ function readApplyAssets(resources, projectRoot) {
   }
   return assets;
 }
+function avatarAssetTarget(resource) {
+  if (resource.kind === RESOURCE_KIND_IDENTITY) {
+    const asset = resource.spec.avatar?.asset;
+    return asset ? { asset, resourceName: resource.metadata.name } : void 0;
+  }
+  if (resource.kind === RESOURCE_KIND_SESSION && typeof resource.spec.identity === "object" && resource.spec.identity !== null && !Array.isArray(resource.spec.identity)) {
+    const asset = resource.spec.identity.avatar?.asset;
+    return asset ? { asset, resourceName: resource.metadata.name } : void 0;
+  }
+  return void 0;
+}
 function validateSessionAvatarAsset(input) {
   if (isAbsolute(input.asset)) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset path must be relative`
+      `Invalid identity avatar asset for "${input.resourceName}": asset path must be relative`
     );
   }
   const relativeAssetPath = input.asset.replaceAll("\\", "/");
   if (!relativeAssetPath.startsWith(".auto/assets/") && relativeAssetPath !== ".auto/assets") {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset path must be under .auto/assets`
+      `Invalid identity avatar asset for "${input.resourceName}": asset path must be under .auto/assets`
     );
   }
   const projectRoot = realpathSync(input.projectRoot);
@@ -21670,7 +21724,7 @@ function validateSessionAvatarAsset(input) {
     assetsRoot = realpathSync(resolve(projectRoot, ".auto", "assets"));
   } catch {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": .auto/assets directory does not exist`
+      `Invalid identity avatar asset for "${input.resourceName}": .auto/assets directory does not exist`
     );
   }
   let resolvedAssetPath;
@@ -21680,28 +21734,28 @@ function validateSessionAvatarAsset(input) {
     stat = statSync(resolvedAssetPath);
   } catch {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": ${input.asset} does not exist`
+      `Invalid identity avatar asset for "${input.resourceName}": ${input.asset} does not exist`
     );
   }
   if (!(resolvedAssetPath === assetsRoot || isInside(resolvedAssetPath, assetsRoot))) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset path must stay inside .auto/assets`
+      `Invalid identity avatar asset for "${input.resourceName}": asset path must stay inside .auto/assets`
     );
   }
   if (!stat.isFile()) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset must be a file`
+      `Invalid identity avatar asset for "${input.resourceName}": asset must be a file`
     );
   }
   if (stat.size > MAX_AVATAR_ASSET_BYTES) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset must be ${MAX_AVATAR_ASSET_BYTES} bytes or smaller`
+      `Invalid identity avatar asset for "${input.resourceName}": asset must be ${MAX_AVATAR_ASSET_BYTES} bytes or smaller`
     );
   }
   const extension = extname(resolvedAssetPath).toLowerCase();
   if (!ALLOWED_AVATAR_EXTENSIONS.has(extension)) {
     throw new Error(
-      `Invalid session identity avatar asset for "${input.resourceName}": asset must be a PNG or JPEG image`
+      `Invalid identity avatar asset for "${input.resourceName}": asset must be a PNG or JPEG image`
     );
   }
   return resolvedAssetPath;
@@ -21770,11 +21824,13 @@ var init_files = __esm({
     init_src();
     APPLY_DIRECTORIES = {
       environment: "environments",
+      identity: "identities",
       tool: "tools",
       session: "sessions"
     };
     APPLY_SCHEMAS = {
       environment: EnvironmentApplyRequestSchema,
+      identity: IdentityApplyRequestSchema,
       tool: ToolApplyRequestSchema,
       session: SessionApplyRequestSchema
     };
@@ -21946,6 +22002,8 @@ async function listProjectResources2(client, kind, options) {
   switch (kind) {
     case RESOURCE_KIND_ENVIRONMENT:
       return (await client.listEnvironments(options)).environments;
+    case RESOURCE_KIND_IDENTITY:
+      return (await client.listIdentities(options)).identities;
     case RESOURCE_KIND_TOOL:
       return (await client.listTools(options)).tools;
     case RESOURCE_KIND_SESSION:
@@ -21980,6 +22038,12 @@ var init_resources3 = __esm({
         label: "Tool",
         pluralLabel: "Tools"
       },
+      [RESOURCE_KIND_IDENTITY]: {
+        kind: RESOURCE_KIND_IDENTITY,
+        section: "identities",
+        label: "Identity",
+        pluralLabel: "Identities"
+      },
       [RESOURCE_KIND_SESSION]: {
         kind: RESOURCE_KIND_SESSION,
         section: "sessions",
@@ -21989,6 +22053,7 @@ var init_resources3 = __esm({
     };
     PROJECT_RESOURCE_TUI_ORDER = [
       RESOURCE_KIND_SESSION,
+      RESOURCE_KIND_IDENTITY,
       RESOURCE_KIND_ENVIRONMENT,
       RESOURCE_KIND_TOOL
     ];
@@ -24443,6 +24508,32 @@ function ToolsView({
     }
   );
 }
+function IdentitiesView({
+  resources,
+  selectedIndex,
+  error: error51
+}) {
+  return /* @__PURE__ */ jsx9(
+    ResourceTable,
+    {
+      rows: resources.map((identity2) => ({
+        id: identity2.metadata.uid,
+        name: identity2.metadata.name,
+        kind: identity2.spec.displayName ?? "",
+        target: identity2.spec.username ?? "",
+        detail: identity2.spec.avatar?.asset ?? identity2.spec.description ?? "",
+        updatedAt: identity2.metadata.updatedAt
+      })),
+      selectedIndex,
+      error: error51,
+      empty: "no identities found",
+      kindHeader: "DISPLAY",
+      targetHeader: "USERNAME",
+      detailHeader: "AVATAR / DESCRIPTION",
+      flexColumn: "detail"
+    }
+  );
+}
 function ServiceAccountsView({
   resources,
   selectedIndex,
@@ -24627,6 +24718,10 @@ function useEnvironments(apiUrl) {
   const client = useApiClient();
   return useQuery(environmentsQueryOptions(client, apiUrl));
 }
+function useIdentities(apiUrl) {
+  const client = useApiClient();
+  return useQuery(identitiesQueryOptions(client, apiUrl));
+}
 function useTools(apiUrl) {
   const client = useApiClient();
   return useQuery(toolsQueryOptions(client, apiUrl));
@@ -24904,6 +24999,14 @@ function environmentsQueryOptions(client, apiUrl) {
     staleTime: Number.POSITIVE_INFINITY
   });
 }
+function identitiesQueryOptions(client, apiUrl) {
+  return queryOptions({
+    queryKey: queryKeys.identities(apiUrl),
+    queryFn: async () => (await client.listIdentities({ apiBaseUrl: apiUrl })).identities,
+    select: sortByName,
+    staleTime: Number.POSITIVE_INFINITY
+  });
+}
 function sessionsQueryOptions(client, apiUrl) {
   return queryOptions({
     queryKey: queryKeys.sessions(apiUrl),
@@ -24999,6 +25102,7 @@ var init_queries = __esm({
     TUI_RUN_LIST_LIMIT = 200;
     queryKeys = {
       environments: (apiUrl) => ["environments", apiUrl],
+      identities: (apiUrl) => ["identities", apiUrl],
       sessions: (apiUrl) => ["sessions", apiUrl],
       tools: (apiUrl) => ["tools", apiUrl],
       projects: (apiUrl) => ["projects", apiUrl],
@@ -25463,6 +25567,8 @@ function selectedNamedResourceForSection(input) {
   switch (input.activeSection) {
     case "environments":
       return input.selectedEnvironment ?? null;
+    case "identities":
+      return input.selectedIdentity ?? null;
     case "sessions":
       return input.selectedSession ?? null;
     case "tools":
@@ -25505,6 +25611,7 @@ function HomeView({ apiUrl, notice, returnToSession }) {
   );
   const [sessionIndex, setSessionIndex] = useState3(0);
   const [environmentIndex, setEnvironmentIndex] = useState3(0);
+  const [identityIndex, setIdentityIndex] = useState3(0);
   const [toolIndex, setToolIndex] = useState3(0);
   const [projectIndex, setProjectIndex] = useState3(0);
   const [serviceAccountIndex, setServiceAccountIndex] = useState3(0);
@@ -25540,6 +25647,11 @@ function HomeView({ apiUrl, notice, returnToSession }) {
     isLoading: isEnvironmentsLoading,
     error: environmentsError
   } = useEnvironments(apiUrl);
+  const {
+    data: identities = [],
+    isLoading: isIdentitiesLoading,
+    error: identitiesError
+  } = useIdentities(apiUrl);
   const {
     data: tools = [],
     isLoading: isToolsLoading,
@@ -25632,11 +25744,13 @@ function HomeView({ apiUrl, notice, returnToSession }) {
   const selectedServiceAccount = serviceAccounts[serviceAccountIndex];
   const selectedSession = sessions[sessionIndex];
   const selectedEnvironment = environments[environmentIndex];
+  const selectedIdentity = identities[identityIndex];
   const selectedTool = tools[toolIndex];
   const selectedInspectableResource = useMemo3(() => {
     const selectedEditable = editableResourceForSelection({
       activeSection,
       selectedEnvironment,
+      selectedIdentity,
       selectedSession,
       selectedTool
     });
@@ -25656,6 +25770,12 @@ function HomeView({ apiUrl, notice, returnToSession }) {
           name: selectedEditable.name,
           spec: selectedEnvironment.spec
         } : null;
+      case "identities":
+        return selectedIdentity ? {
+          kind: selectedEditable.kind,
+          name: selectedEditable.name,
+          spec: selectedIdentity.spec
+        } : null;
       case "tools":
         return selectedTool ? {
           kind: selectedEditable.kind,
@@ -25665,15 +25785,28 @@ function HomeView({ apiUrl, notice, returnToSession }) {
       default:
         return null;
     }
-  }, [activeSection, selectedEnvironment, selectedSession, selectedTool]);
+  }, [
+    activeSection,
+    selectedEnvironment,
+    selectedIdentity,
+    selectedSession,
+    selectedTool
+  ]);
   const selectedEditableResource = useMemo3(
     () => editableResourceForSelection({
       activeSection,
       selectedEnvironment,
+      selectedIdentity,
       selectedSession,
       selectedTool
     }),
-    [activeSection, selectedEnvironment, selectedSession, selectedTool]
+    [
+      activeSection,
+      selectedEnvironment,
+      selectedIdentity,
+      selectedSession,
+      selectedTool
+    ]
   );
   const inspectPanelHeight = Math.max(1, termHeight - 12);
   const scopedSession = runScopeSessionName ? sessions.find((session) => session.metadata.name === runScopeSessionName) : void 0;
@@ -26267,6 +26400,16 @@ function HomeView({ apiUrl, notice, returnToSession }) {
         return;
       }
     }
+    if (activeSection === "identities") {
+      if (key.upArrow) {
+        setIdentityIndex((i) => Math.max(0, i - 1));
+        return;
+      }
+      if (key.downArrow) {
+        setIdentityIndex((i) => clampListIndex(i + 1, identities.length));
+        return;
+      }
+    }
     if (activeSection === "tools") {
       if (key.upArrow) {
         setToolIndex((i) => Math.max(0, i - 1));
@@ -26557,9 +26700,10 @@ function HomeView({ apiUrl, notice, returnToSession }) {
       sectionTitle = `Service Accounts[${serviceAccounts.length}]`;
       break;
     case "environments":
+    case "identities":
     case "tools": {
       const definition = PROJECT_RESOURCE_TUI_DEFINITIONS_BY_SECTION.get(activeSection);
-      const count = activeSection === "environments" ? environments.length : tools.length;
+      const count = activeSection === "environments" ? environments.length : activeSection === "identities" ? identities.length : tools.length;
       sectionTitle = `${definition?.pluralLabel ?? activeSection}[${count}]`;
       break;
     }
@@ -26738,6 +26882,13 @@ function HomeView({ apiUrl, notice, returnToSession }) {
             selectedSession,
             error: toolsError instanceof Error ? toolsError.message : toolsError ? String(toolsError) : null
           }
+        ) : activeSection === "identities" ? isIdentitiesLoading ? /* @__PURE__ */ jsx14(Box13, { padding: 2, children: /* @__PURE__ */ jsx14(Spinner, { label: "loading identities\u2026" }) }) : /* @__PURE__ */ jsx14(
+          IdentitiesView,
+          {
+            resources: identities,
+            selectedIndex: identityIndex,
+            error: identitiesError instanceof Error ? identitiesError.message : identitiesError ? String(identitiesError) : null
+          }
         ) : activeSection === "sessions" ? /* @__PURE__ */ jsx14(
           SessionsView,
           {
@@ -26842,7 +26993,7 @@ function HomeView({ apiUrl, notice, returnToSession }) {
         /* @__PURE__ */ jsx14(Text14, { dimColor: true, children: ` ${inspectedResource.name} ` }),
         /* @__PURE__ */ jsx14(Text14, { dimColor: true, children: "\u203A" }),
         /* @__PURE__ */ jsx14(Text14, { backgroundColor: "cyan", color: "black", children: " inspect " })
-      ] }) : (activeSection === "projects" || activeSection === "environments" || activeSection === "tools" || activeSection === "serviceAccounts" || activeSection === "connections") && /* @__PURE__ */ jsx14(
+      ] }) : (activeSection === "projects" || activeSection === "environments" || activeSection === "identities" || activeSection === "tools" || activeSection === "serviceAccounts" || activeSection === "connections") && /* @__PURE__ */ jsx14(
         Text14,
         {
           backgroundColor: "cyan",
@@ -27082,10 +27233,11 @@ var init_HomeView = __esm({
       resourceNavItem({ k: "1", section: "sessions" }),
       { k: "2", label: "Runs", activeSection: "runs" },
       resourceNavItem({ k: "3", section: "environments" }),
-      resourceNavItem({ k: "4", section: "tools" }),
-      { k: "5", label: "Projects", activeSection: "projects" },
-      { k: "6", label: "Service Accounts", activeSection: "serviceAccounts" },
-      { k: "7", label: "Connections", activeSection: "connections" }
+      resourceNavItem({ k: "4", section: "identities" }),
+      resourceNavItem({ k: "5", section: "tools" }),
+      { k: "6", label: "Projects", activeSection: "projects" },
+      { k: "7", label: "Service Accounts", activeSection: "serviceAccounts" },
+      { k: "8", label: "Connections", activeSection: "connections" }
     ];
     RESOURCES_PER_COLUMN = 4;
   }
@@ -27194,6 +27346,7 @@ async function launch(opts) {
   });
   const prefetchP = Promise.allSettled([
     apiClient.listSessions({ apiBaseUrl: apiUrl }),
+    apiClient.listIdentities({ apiBaseUrl: apiUrl }),
     apiClient.listProjects({ apiBaseUrl: apiUrl }),
     apiClient.listProjectServiceAccounts({ apiBaseUrl: apiUrl }),
     apiClient.listConnections({ apiBaseUrl: apiUrl }),
@@ -27206,6 +27359,7 @@ async function launch(opts) {
   const [, prefetchResult] = await Promise.all([waitSplash(), prefetchP]);
   const [
     sessionsResult,
+    identitiesResult,
     projectsResult,
     serviceAccountsResult,
     connectionsResult,
@@ -27217,6 +27371,12 @@ async function launch(opts) {
       sortSessions(sessionsResult.value.sessions)
     );
   }
+  if (identitiesResult.status === "fulfilled") {
+    queryClient.setQueryData(
+      queryKeys.identities(apiUrl),
+      sortByResourceName(identitiesResult.value.identities)
+    );
+  }
   if (projectsResult.status === "fulfilled") {
     queryClient.setQueryData(
       queryKeys.projects(apiUrl),
@@ -27348,6 +27508,13 @@ var init_launcher = __esm({
         queryKey: queryKeys.tools,
         sort: sortByResourceName
       },
+      [RESOURCE_KIND_IDENTITY]: {
+        async list({ apiClient, apiUrl }) {
+          return (await apiClient.listIdentities({ apiBaseUrl: apiUrl })).identities;
+        },
+        queryKey: queryKeys.identities,
+        sort: sortByResourceName
+      },
       [RESOURCE_KIND_SESSION]: {
         async list({ apiClient, apiUrl }) {
           return (await apiClient.listSessions({ apiBaseUrl: apiUrl })).sessions;