@meshagent/meshagent-ts-auth 0.36.3 → 0.37.0

package/dist/browser/ma-auth.global.js

@@ -3047,7 +3047,8 @@ meshagent.auth = (() => {
     "../meshagent-ts/dist/browser/agent.js"(exports) {
       "use strict";
       Object.defineProperty(exports, "__esModule", { value: true });
-      exports.RemoteTaskRunner = exports.RemoteToolkit = exports.Toolkit = exports.Tool = void 0;
+      exports.RemoteTaskRunner = exports.HostedToolkit = exports.Toolkit = exports.Tool = void 0;
+      exports.startHostedToolkit = startHostedToolkit;
       var response_1 = require_response();
       var tool_content_type_1 = require_tool_content_type();
       var utils_1 = require_utils();
@@ -3097,7 +3098,11 @@ meshagent.auth = (() => {
       };
       exports.Tool = Tool;
       var Toolkit = class {
-        constructor({ tools, rules = [] }) {
+        constructor({ name, title = name, description = "", thumbnailUrl, tools, rules = [] }) {
+          this.name = name;
+          this.title = title;
+          this.description = description;
+          this.thumbnailUrl = thumbnailUrl;
           this.tools = tools;
           this.rules = rules;
         }
@@ -3126,30 +3131,38 @@ meshagent.auth = (() => {
         }
       };
       exports.Toolkit = Toolkit;
-      var RemoteToolkit = class extends Toolkit {
-        constructor({ name, title, description, room, tools, rules = [] }) {
-          super({ tools, rules });
+      var HostedToolkit = class {
+        constructor({ toolkit, stopHostedToolkit }) {
+          this.toolkit = toolkit;
+          this._stopHostedToolkit = stopHostedToolkit;
+        }
+        async stop() {
+          await this._stopHostedToolkit();
+        }
+      };
+      exports.HostedToolkit = HostedToolkit;
+      var _RemoteToolkitWrapper = class {
+        constructor({ toolkit, room }) {
+          this.toolkit = toolkit;
           this.client = room;
-          this.name = name;
-          this.title = title;
-          this.description = description;
         }
         async start({ public_: isPublic = false } = {}) {
           const handler = this._toolCall.bind(this);
-          this.client.protocol.addHandler(`room.tool_call.${this.name}`, handler);
+          this.client.protocol.addHandler(`room.tool_call.${this.toolkit.name}`, handler);
           await this._register(isPublic);
         }
         async stop() {
           await this._unregister();
-          this.client.protocol.removeHandler(`room.tool_call.${this.name}`);
+          this.client.protocol.removeHandler(`room.tool_call.${this.toolkit.name}`);
         }
         async _register(public_) {
           const response = await this.client.sendRequest("room.register_toolkit", {
-            name: this.name,
-            title: this.title,
-            description: this.description,
-            tools: this.getTools(),
-            public: public_
+            name: this.toolkit.name,
+            title: this.toolkit.title,
+            description: this.toolkit.description,
+            tools: this.toolkit.getTools(),
+            public: public_,
+            thumbnail_url: this.toolkit.thumbnailUrl
           });
           const json = response.json;
           this._registrationId = json["id"];
@@ -3180,7 +3193,7 @@ meshagent.auth = (() => {
             } else {
               args = rawArguments ?? {};
             }
-            const response = await this.execute(toolName, args);
+            const response = await this.toolkit.execute(toolName, args);
             await this.client.protocol.send("room.tool_call_response", response.pack(), messageId);
           } catch (e) {
             const err = new response_1.ErrorContent({ text: String(e) });
@@ -3188,7 +3201,14 @@ meshagent.auth = (() => {
           }
         }
       };
-      exports.RemoteToolkit = RemoteToolkit;
+      async function startHostedToolkit({ room, toolkit, public_: isPublic = false }) {
+        const wrapper = new _RemoteToolkitWrapper({ toolkit, room });
+        await wrapper.start({ public_: isPublic });
+        return new HostedToolkit({
+          toolkit,
+          stopHostedToolkit: () => wrapper.stop()
+        });
+      }
       var RemoteTaskRunner = class {
         constructor({ name, description, client, inputSchema, outputSchema, supportsTools = false, required = [] }) {
           this.client = client;
@@ -3214,10 +3234,10 @@ meshagent.auth = (() => {
     "../meshagent-ts/dist/browser/agent-client.js"(exports) {
       "use strict";
       Object.defineProperty(exports, "__esModule", { value: true });
-      exports.AgentsClient = exports.ToolkitConfiguration = exports.ToolkitDescription = exports.ToolDescription = void 0;
+      exports.AgentsClient = exports.ToolkitDescription = exports.ToolDescription = void 0;
       var tool_content_type_1 = require_tool_content_type();
       var ToolDescription = class {
-        constructor({ title, name, description, inputSchema, inputSpec, outputSpec, outputSchema, thumbnailUrl, defs, pricing, supportsContext }) {
+        constructor({ title, name, description, inputSchema, inputSpec, outputSpec, outputSchema, thumbnailUrl, defs, pricing }) {
           this.title = title;
           this.name = name;
           this.description = description;
@@ -3254,7 +3274,6 @@ meshagent.auth = (() => {
           this.thumbnailUrl = thumbnailUrl;
           this.defs = defs;
           this.pricing = pricing;
-          this.supportsContext = supportsContext ?? false;
         }
         get inputSchema() {
           return this.inputSpec?.schema;
@@ -3294,8 +3313,7 @@ meshagent.auth = (() => {
               output_spec: tool.outputSpec?.toJson(),
               thumbnail_url: tool.thumbnailUrl,
               defs: tool.defs,
-              pricing: tool.pricing,
-              supports_context: tool.supportsContext
+              pricing: tool.pricing
             }))
           };
         }
@@ -3319,8 +3337,7 @@ meshagent.auth = (() => {
                 outputSpec: tool_content_type_1.ToolContentSpec.fromJson(tool["output_spec"]),
                 thumbnailUrl: tool["thumbnail_url"],
                 defs: tool["defs"],
-                pricing: tool["pricing"],
-                supportsContext: tool["supports_context"] ?? tool["supportsContext"]
+                pricing: tool["pricing"]
               }));
             }
           } else if (typeof json["tools"] === "object" && json["tools"] !== null) {
@@ -3337,8 +3354,7 @@ meshagent.auth = (() => {
                 outputSpec: tool_content_type_1.ToolContentSpec.fromJson(tool["output_spec"]),
                 thumbnailUrl: tool["thumbnail_url"],
                 defs: tool["defs"],
-                pricing: tool["pricing"],
-                supportsContext: tool["supports_context"] ?? tool["supportsContext"]
+                pricing: tool["pricing"]
               }));
             }
           }
@@ -3353,29 +3369,6 @@ meshagent.auth = (() => {
         }
       };
       exports.ToolkitDescription = ToolkitDescription;
-      var ToolkitConfiguration = class {
-        constructor(name, use) {
-          this.name = name;
-          this.use = use;
-        }
-        toJson() {
-          if (!this.use) {
-            return {
-              [this.name]: {}
-            };
-          } else {
-            return {
-              [this.name]: {
-                use: this.use.reduce((acc, tool) => {
-                  acc[tool] = {};
-                  return acc;
-                }, {})
-              }
-            };
-          }
-        }
-      };
-      exports.ToolkitConfiguration = ToolkitConfiguration;
       var AgentsClient = class {
         constructor({ room }) {
           this.client = room;
@@ -14947,19 +14940,28 @@ ${err.toString()}`);
           exitCode: readOptionalIntegerField(data, "exit_code", operation)
         };
       }
-      function buildRequestPayload(params) {
-        return {
-          tag: params.tag,
-          mounts: toMountList(params.mounts),
-          context_path: params.contextPath,
-          dockerfile_path: params.dockerfilePath ?? null,
-          private: params.private ?? false,
-          credentials: toCredentials(params.credentials ?? []),
-          context_archive_path: params.contextArchivePath ?? null,
-          context_archive_ref: params.contextArchiveRef ?? null,
-          context_archive_mount_path: params.contextArchiveMountPath ?? null,
-          context_archive_arch: params.contextArchiveArch ?? null
-        };
+      async function* buildInputStream(params) {
+        yield new response_1.BinaryContent({
+          data: new Uint8Array(0),
+          headers: {
+            kind: "start",
+            tag: params.tag,
+            mount_path: params.mountPath,
+            context_path: params.contextPath,
+            dockerfile_path: params.dockerfilePath ?? null,
+            optimize_image: params.optimizeImage ?? true,
+            private: params.private ?? false,
+            credentials: toCredentials(params.credentials ?? []),
+            builder_name: params.builderName ?? null,
+            size: params.size ?? null
+          }
+        });
+        for await (const chunk of params.chunks) {
+          yield new response_1.BinaryContent({
+            data: new Uint8Array(chunk),
+            headers: { kind: "data" }
+          });
+        }
       }
       var ExecSession = class {
         constructor(params) {
@@ -15200,15 +15202,12 @@ ${err.toString()}`);
           }
           return readStringField(output.json, "container_id", "run");
         }
-        async startBuild(params) {
-          const output = await this.invoke("start_build", buildRequestPayload(params));
-          if (!(output instanceof response_1.JsonContent) || !isRecord(output.json)) {
-            throw this.unexpectedResponseError("start_build");
-          }
-          return readStringField(output.json, "build_id", "start_build");
-        }
         async build(params) {
-          const output = await this.invoke("build", buildRequestPayload(params));
+          const output = await this.room.invokeWithStreamInput({
+            toolkit: "containers",
+            tool: "build",
+            input: buildInputStream(params)
+          });
           if (!(output instanceof response_1.JsonContent) || !isRecord(output.json)) {
             throw this.unexpectedResponseError("build");
           }
@@ -15585,7 +15584,7 @@ ${err.toString()}`);
     "../meshagent-ts/dist/browser/data-types.js"(exports) {
       "use strict";
       Object.defineProperty(exports, "__esModule", { value: true });
-      exports.BinaryDataType = exports.TextDataType = exports.VectorDataType = exports.FloatDataType = exports.DateDataType = exports.IntDataType = exports.BoolDataType = exports.DataType = exports._dataTypes = void 0;
+      exports.BinaryDataType = exports.UuidDataType = exports.JsonDataType = exports.TextDataType = exports.VectorDataType = exports.FloatDataType = exports.DateDataType = exports.IntDataType = exports.BoolDataType = exports.DataType = exports._dataTypes = void 0;
       exports._dataTypes = {};
       var DataType = class {
         constructor(_) {
@@ -15612,6 +15611,12 @@ ${err.toString()}`);
         static text() {
           return new TextDataType();
         }
+        static json() {
+          return new JsonDataType();
+        }
+        static uuid() {
+          return new UuidDataType();
+        }
         static binary() {
           return new BinaryDataType();
         }
@@ -15722,6 +15727,38 @@ ${err.toString()}`);
       };
       exports.TextDataType = TextDataType;
       exports._dataTypes["text"] = TextDataType;
+      var JsonDataType = class _JsonDataType extends DataType {
+        constructor() {
+          super();
+        }
+        static fromJson(data) {
+          if (data.type !== "json") {
+            throw new Error(`Expected type 'json', got '${data.type}'`);
+          }
+          return new _JsonDataType();
+        }
+        toJson() {
+          return { type: "json" };
+        }
+      };
+      exports.JsonDataType = JsonDataType;
+      exports._dataTypes["json"] = JsonDataType;
+      var UuidDataType = class _UuidDataType extends DataType {
+        constructor() {
+          super();
+        }
+        static fromJson(data) {
+          if (data.type !== "uuid") {
+            throw new Error(`Expected type 'uuid', got '${data.type}'`);
+          }
+          return new _UuidDataType();
+        }
+        toJson() {
+          return { type: "uuid" };
+        }
+      };
+      exports.UuidDataType = UuidDataType;
+      exports._dataTypes["uuid"] = UuidDataType;
       var BinaryDataType = class _BinaryDataType extends DataType {
         constructor() {
           super();
@@ -15746,11 +15783,109 @@ ${err.toString()}`);
     "../meshagent-ts/dist/browser/database-client.js"(exports) {
       "use strict";
       Object.defineProperty(exports, "__esModule", { value: true });
-      exports.DatabaseClient = void 0;
+      exports.DatabaseClient = exports.DatabaseUuid = exports.DatabaseJson = exports.DatabaseStruct = exports.DatabaseDate = exports.DatabaseExpression = exports.DatabaseValueEncoder = void 0;
       var data_types_1 = require_data_types();
       var room_server_client_1 = require_room_server_client();
       var response_1 = require_response();
+      var DatabaseValueEncoder = class {
+      };
+      exports.DatabaseValueEncoder = DatabaseValueEncoder;
+      var DatabaseExpression = class extends DatabaseValueEncoder {
+        constructor(expression) {
+          super();
+          const normalized = expression.trim();
+          if (normalized === "") {
+            throw new TypeError("database expression must not be empty");
+          }
+          this.expression = normalized;
+        }
+        encodeDatabaseValue() {
+          return {
+            expression: this.expression
+          };
+        }
+        toString() {
+          return this.expression;
+        }
+      };
+      exports.DatabaseExpression = DatabaseExpression;
+      var DatabaseDate = class extends DatabaseValueEncoder {
+        constructor(value) {
+          super();
+          const normalized = value.trim();
+          const parsed = /* @__PURE__ */ new Date(`${normalized}T00:00:00Z`);
+          if (!ISO_DATE_REGEX.test(normalized) || Number.isNaN(parsed.getTime()) || parsed.toISOString().slice(0, 10) !== normalized) {
+            throw new TypeError("invalid database date format");
+          }
+          this.value = normalized;
+        }
+        encodeDatabaseValue() {
+          return {
+            date: this.value
+          };
+        }
+        toString() {
+          return this.value;
+        }
+      };
+      exports.DatabaseDate = DatabaseDate;
+      var DatabaseStruct = class extends DatabaseValueEncoder {
+        constructor(fields) {
+          super();
+          this.fields = Object.fromEntries(Object.entries(fields).map(([key, value]) => {
+            if (typeof key !== "string") {
+              throw new TypeError("database struct keys must be strings");
+            }
+            return [key, value];
+          }));
+        }
+        toJson() {
+          return Object.fromEntries(Object.entries(this.fields).map(([key, value]) => [key, encodeRecordValue(value)]));
+        }
+        encodeDatabaseValue() {
+          return {
+            struct: this.toJson()
+          };
+        }
+      };
+      exports.DatabaseStruct = DatabaseStruct;
+      var DatabaseJson = class extends DatabaseValueEncoder {
+        constructor(value) {
+          super();
+          this.value = normalizeDatabaseJsonValue(value);
+        }
+        toJson() {
+          return this.value;
+        }
+        encodeDatabaseValue() {
+          return {
+            json: this.value
+          };
+        }
+      };
+      exports.DatabaseJson = DatabaseJson;
       var globalScope = globalThis;
+      var UUID_HEX_REGEX = /^[0-9a-f]{32}$/;
+      var ISO_DATE_REGEX = /^\d{4}-\d{2}-\d{2}$/;
+      function normalizeUuidHex(value) {
+        const normalized = value.trim().toLowerCase().replace(/-/g, "");
+        if (!UUID_HEX_REGEX.test(normalized)) {
+          throw new room_server_client_1.RoomServerException("invalid uuid format");
+        }
+        return normalized;
+      }
+      function formatUuidHex(value) {
+        return `${value.substring(0, 8)}-${value.substring(8, 12)}-${value.substring(12, 16)}-${value.substring(16, 20)}-${value.substring(20)}`;
+      }
+      var DatabaseUuid = class {
+        constructor(value) {
+          this.value = formatUuidHex(normalizeUuidHex(value));
+        }
+        toString() {
+          return this.value;
+        }
+      };
+      exports.DatabaseUuid = DatabaseUuid;
       function bytesToBase64(bytes) {
         if (globalScope.Buffer) {
           return globalScope.Buffer.from(bytes).toString("base64");
@@ -15781,13 +15916,28 @@ ${err.toString()}`);
       function isRecord(value) {
         return typeof value === "object" && value !== null && !Array.isArray(value);
       }
+      function isPlainRecord(value) {
+        return isRecord(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+      }
+      function normalizeDatabaseJsonValue(value) {
+        if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") {
+          return value;
+        }
+        if (Array.isArray(value)) {
+          return value.map((item) => normalizeDatabaseJsonValue(item));
+        }
+        if (isPlainRecord(value)) {
+          return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, normalizeDatabaseJsonValue(item)]));
+        }
+        throw new TypeError("database json values must be valid JSON");
+      }
       function metadataEntries(metadata) {
         if (metadata == null) {
           return null;
         }
         return Object.entries(metadata).map(([key, value]) => ({
           key,
-          value: typeof value === "string" ? value : JSON.stringify(encodeLegacyValue(value))
+          value: typeof value === "string" ? value : JSON.stringify(value)
         }));
       }
       function toolkitDataTypeJson(dataType) {
@@ -15874,125 +16024,124 @@ ${err.toString()}`);
         }
         return payload;
       }
-      function encodeLegacyValue(value) {
+      function encodeRecordValue(value) {
+        if (value instanceof DatabaseValueEncoder) {
+          return value.encodeDatabaseValue();
+        }
+        if (value instanceof DatabaseUuid) {
+          return {
+            uuid: value.toString()
+          };
+        }
         if (value instanceof Uint8Array) {
           return {
-            encoding: "base64",
-            data: bytesToBase64(value)
+            binary: bytesToBase64(value)
           };
         }
         if (value instanceof Date) {
-          return value.toISOString().replace("+00:00", "Z");
+          return {
+            timestamp: value.toISOString().replace("+00:00", "Z")
+          };
         }
         if (Array.isArray(value)) {
-          return value.map((item) => encodeLegacyValue(item));
+          return {
+            list: value.map((item) => encodeRecordValue(item))
+          };
         }
         if (isRecord(value)) {
-          return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, encodeLegacyValue(entryValue)]));
+          throw new room_server_client_1.RoomServerException("database object values must use DatabaseStruct or DatabaseJson");
         }
         return value;
       }
-      function encodeStreamValue(value) {
-        if (value == null) {
-          return { type: "null" };
+      function databaseSqlLiteral(value) {
+        if (value instanceof DatabaseUuid) {
+          return `X'${normalizeUuidHex(value.toString())}'`;
         }
-        if (typeof value === "boolean") {
-          return { type: "bool", value };
-        }
-        if (typeof value === "number") {
-          if (Number.isInteger(value)) {
-            return { type: "int", value };
-          }
-          return { type: "float", value };
+        if (value instanceof DatabaseDate) {
+          return JSON.stringify(value.toString());
         }
-        if (typeof value === "string") {
-          return { type: "text", value };
+        if (value instanceof Date) {
+          return JSON.stringify(value.toISOString().replace("+00:00", "Z"));
         }
-        if (value instanceof Uint8Array) {
-          return {
-            type: "binary",
-            data: bytesToBase64(value)
-          };
+        if (value instanceof DatabaseJson) {
+          return JSON.stringify(JSON.stringify(value.toJson()));
         }
-        if (value instanceof Date) {
-          return {
-            type: "timestamp",
-            value: value.toISOString().replace("+00:00", "Z")
-          };
+        if (value instanceof DatabaseStruct) {
+          const fields = Object.entries(value.fields).map(([key, fieldValue]) => `${JSON.stringify(key)}, ${databaseSqlLiteral(fieldValue)}`);
+          return `named_struct(${fields.join(", ")})`;
         }
+        return JSON.stringify(encodeRecordValue(value));
+      }
+      function decodeRecordValue(value) {
         if (Array.isArray(value)) {
-          return {
-            type: "list",
-            items: value.map((item) => encodeStreamValue(item))
-          };
+          throw new room_server_client_1.RoomServerException("database list values must use a {'list': [...]} wrapper");
         }
-        if (isRecord(value)) {
-          return {
-            type: "struct",
-            fields: Object.entries(value).map(([name, fieldValue]) => ({
-              name,
-              value: encodeStreamValue(fieldValue)
-            }))
-          };
+        if (!isRecord(value)) {
+          return value;
         }
-        throw new room_server_client_1.RoomServerException(`database stream does not support value type ${typeof value}`);
-      }
-      function decodeStreamValue(value, operation) {
-        if (!isRecord(value) || typeof value.type !== "string") {
-          throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
+        const entries = Object.entries(value);
+        if (entries.length !== 1) {
+          throw new room_server_client_1.RoomServerException("database object values must use a single-key type wrapper");
         }
-        switch (value.type) {
-          case "null":
-            return null;
-          case "bool":
-            if (typeof value.value !== "boolean") {
-              throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
+        const [wrapper, payload] = entries[0];
+        switch (wrapper) {
+          case "binary":
+            if (typeof payload !== "string") {
+              throw new room_server_client_1.RoomServerException("database binary values must be base64 strings");
             }
-            return value.value;
-          case "int":
-          case "float":
-            if (typeof value.value !== "number") {
-              throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
+            return base64ToBytes(payload);
+          case "uuid":
+            if (typeof payload !== "string") {
+              throw new room_server_client_1.RoomServerException("database uuid values must be strings");
             }
-            return value.value;
-          case "text":
+            return new DatabaseUuid(payload);
+          case "expression":
+            if (typeof payload !== "string") {
+              throw new room_server_client_1.RoomServerException("database expression values must be strings");
+            }
+            return new DatabaseExpression(payload);
           case "date":
+            if (typeof payload !== "string") {
+              throw new room_server_client_1.RoomServerException("database date values must be strings");
+            }
+            return new DatabaseDate(payload);
           case "timestamp":
-            if (typeof value.value !== "string") {
-              throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
+            if (typeof payload !== "string") {
+              throw new room_server_client_1.RoomServerException("database timestamp values must be strings");
             }
-            return value.value;
-          case "binary":
-            if (typeof value.data !== "string") {
-              throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
+            {
+              const parsed = new Date(payload);
+              if (Number.isNaN(parsed.getTime())) {
+                throw new room_server_client_1.RoomServerException("database timestamp value is not valid");
+              }
+              return parsed;
             }
-            return base64ToBytes(value.data);
           case "list":
-            if (!Array.isArray(value.items)) {
-              throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
+            if (!Array.isArray(payload)) {
+              throw new room_server_client_1.RoomServerException("database list values must be arrays");
             }
-            return value.items.map((item) => decodeStreamValue(item, operation));
+            return payload.map((item) => decodeRecordValue(item));
           case "struct":
-            if (!Array.isArray(value.fields)) {
-              throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
+            if (!isRecord(payload)) {
+              throw new room_server_client_1.RoomServerException("database struct values must be objects");
             }
-            return Object.fromEntries(value.fields.map((field) => {
-              if (!isRecord(field) || typeof field.name !== "string") {
-                throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
-              }
-              return [field.name, decodeStreamValue(field.value, operation)];
-            }));
+            return new DatabaseStruct(Object.fromEntries(Object.entries(payload).map(([key, item]) => [key, decodeRecordValue(item)])));
+          case "json":
+            return new DatabaseJson(normalizeDatabaseJsonValue(payload));
           default:
-            throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
+            throw new room_server_client_1.RoomServerException(`unsupported database value wrapper '${wrapper}'`);
         }
       }
+      function encodeDatabaseRecord(record) {
+        return Object.fromEntries(Object.entries(record).map(([key, value]) => [key, encodeRecordValue(value)]));
+      }
       function rowsChunk(records) {
         return {
           kind: "rows",
           rows: records.map((record) => ({
             columns: Object.entries(record).map(([name, value]) => ({
               name,
-              value: encodeStreamValue(value)
+              value: encodeRecordValue(value)
             }))
           }))
         };
@@ -16009,7 +16158,11 @@ ${err.toString()}`);
             if (!isRecord(column) || typeof column.name !== "string") {
               throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
             }
-            return [column.name, decodeStreamValue(column.value, operation)];
+            try {
+              return [column.name, decodeRecordValue(column.value)];
+            } catch {
+              throw new room_server_client_1.RoomServerException(`unexpected return type from database.${operation}`);
+            }
           }));
         });
       }
@@ -16036,7 +16189,7 @@ ${err.toString()}`);
       }
       function buildWhereClause(where) {
         if (where != null && typeof where === "object" && !Array.isArray(where)) {
-          return Object.entries(where).map(([key, value]) => `${key} = ${JSON.stringify(encodeLegacyValue(value))}`).join(" AND ");
+          return Object.entries(where).map(([key, value]) => `${key} = ${databaseSqlLiteral(value)}`).join(" AND ");
         }
         if (typeof where === "string") {
           return where;
@@ -16084,6 +16237,37 @@ ${err.toString()}`);
           metadata
         };
       }
+      function tableBranchFromJson(value) {
+        if (!isRecord(value) || typeof value.name !== "string") {
+          throw new room_server_client_1.RoomServerException("unexpected return type from database.list_branches");
+        }
+        if (value.parent_branch != null && typeof value.parent_branch !== "string") {
+          throw new room_server_client_1.RoomServerException("unexpected return type from database.list_branches");
+        }
+        if (value.parent_version != null && (typeof value.parent_version !== "number" || !Number.isInteger(value.parent_version))) {
+          throw new room_server_client_1.RoomServerException("unexpected return type from database.list_branches");
+        }
+        if (value.manifest_size != null && (typeof value.manifest_size !== "number" || !Number.isInteger(value.manifest_size))) {
+          throw new room_server_client_1.RoomServerException("unexpected return type from database.list_branches");
+        }
+        let createdAt = null;
+        if (value.created_at != null) {
+          if (typeof value.created_at !== "string") {
+            throw new room_server_client_1.RoomServerException("unexpected return type from database.list_branches");
+          }
+          createdAt = new Date(value.created_at);
+          if (Number.isNaN(createdAt.getTime())) {
+            throw new room_server_client_1.RoomServerException("unexpected return type from database.list_branches");
+          }
+        }
+        return {
+          name: value.name,
+          parentBranch: value.parent_branch ?? null,
+          parentVersion: value.parent_version ?? null,
+          createdAt,
+          manifestSize: value.manifest_size ?? null
+        };
+      }
       var DatabaseWriteInputStream = class {
         constructor(start, chunks) {
           this.start = start;
@@ -16262,118 +16446,132 @@ ${err.toString()}`);
             input.close();
           }
         }
-        async listTables({ namespace } = {}) {
-          const response = await this.invoke("list_tables", { namespace: namespace ?? null });
+        async listTables({ namespace, branch } = {}) {
+          const response = await this.invoke("list_tables", {
+            namespace: namespace ?? null,
+            branch: branch ?? null
+          });
           if (!(response instanceof response_1.JsonContent)) {
             throw this._unexpectedResponseError("list_tables");
           }
           return Array.isArray(response.json.tables) ? response.json.tables : [];
         }
-        async createTable({ name, data, schema, mode = "create", namespace, metadata }) {
+        async createTable({ name, data, schema, mode = "create", namespace, branch, metadata }) {
           const input = new DatabaseWriteInputStream({
             kind: "start",
             name,
             fields: schemaEntries(schema),
             mode,
             namespace: namespace ?? null,
+            branch: branch ?? null,
             metadata: metadataEntries(metadata)
           }, data ?? []);
           await this.drainWriteStream("create_table", input);
         }
-        async createTableWithSchema({ name, schema, data, mode = "create", namespace, metadata }) {
+        async createTableWithSchema({ name, schema, data, mode = "create", namespace, branch, metadata }) {
           return this.createTable({
             name,
             schema,
             data: data == null ? void 0 : rowChunkList(data),
             mode,
             namespace,
+            branch,
             metadata
           });
         }
-        async createTableFromData({ name, data, mode = "create", namespace, metadata }) {
+        async createTableFromData({ name, data, mode = "create", namespace, branch, metadata }) {
           return this.createTable({
             name,
             data: data == null ? void 0 : rowChunkList(data),
             mode,
             namespace,
+            branch,
             metadata
           });
         }
-        async createTableFromDataStream({ name, chunks, schema, mode = "create", namespace, metadata }) {
-          return this.createTable({ name, data: chunks, schema, mode, namespace, metadata });
+        async createTableFromDataStream({ name, chunks, schema, mode = "create", namespace, branch, metadata }) {
+          return this.createTable({ name, data: chunks, schema, mode, namespace, branch, metadata });
         }
-        async dropTable({ name, ignoreMissing = false, namespace }) {
+        async dropTable({ name, ignoreMissing = false, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
             tool: "drop_table",
-            input: { name, ignore_missing: ignoreMissing, namespace: namespace ?? null }
+            input: {
+              name,
+              ignore_missing: ignoreMissing,
+              namespace: namespace ?? null,
+              branch: branch ?? null
+            }
           });
         }
-        async dropIndex({ table, name, namespace }) {
+        async dropIndex({ table, name, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
             tool: "drop_index",
-            input: { table, name, namespace: namespace ?? null }
+            input: { table, name, namespace: namespace ?? null, branch: branch ?? null }
           });
         }
-        async addColumns({ table, newColumns, namespace }) {
+        async addColumns({ table, newColumns, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
             tool: "add_columns",
             input: {
               table,
               columns: Object.entries(newColumns).map(([name, value]) => value instanceof data_types_1.DataType ? { name, value_sql: null, data_type: toolkitDataTypeJson(value) } : { name, value_sql: value, data_type: null }),
-              namespace: namespace ?? null
+              namespace: namespace ?? null,
+              branch: branch ?? null
             }
           });
         }
-        async dropColumns({ table, columns, namespace }) {
+        async dropColumns({ table, columns, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
             tool: "drop_columns",
-            input: { table, columns, namespace: namespace ?? null }
+            input: { table, columns, namespace: namespace ?? null, branch: branch ?? null }
           });
         }
-        async insert({ table, records, namespace }) {
-          await this.insertStream({ table, chunks: rowChunkList(records), namespace });
+        async insert({ table, records, namespace, branch }) {
+          await this.insertStream({ table, chunks: rowChunkList(records), namespace, branch });
         }
-        async insertStream({ table, chunks, namespace }) {
+        async insertStream({ table, chunks, namespace, branch }) {
           const input = new DatabaseWriteInputStream({
             kind: "start",
             table,
-            namespace: namespace ?? null
+            namespace: namespace ?? null,
+            branch: branch ?? null
           }, chunks);
           await this.drainWriteStream("insert", input);
         }
-        async update({ table, where, values, valuesSql, namespace }) {
+        async update({ table, where, values, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
             tool: "update",
             input: {
               table,
               where,
-              values: values == null ? null : Object.entries(values).map(([column, value]) => ({ column, value_json: JSON.stringify(encodeLegacyValue(value)) })),
-              values_sql: valuesSql == null ? null : Object.entries(valuesSql).map(([column, expression]) => ({ column, expression })),
-              namespace: namespace ?? null
+              values: Object.entries(values).map(([column, value]) => ({ column, value_json: JSON.stringify(encodeRecordValue(value)) })),
+              namespace: namespace ?? null,
+              branch: branch ?? null
             }
           });
         }
-        async delete({ table, where, namespace }) {
+        async delete({ table, where, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
             tool: "delete",
-            input: { table, where, namespace: namespace ?? null }
+            input: { table, where, namespace: namespace ?? null, branch: branch ?? null }
           });
         }
-        async merge({ table, on, records, namespace }) {
-          await this.mergeStream({ table, on, chunks: rowChunkList(records), namespace });
+        async merge({ table, on, records, namespace, branch }) {
+          await this.mergeStream({ table, on, chunks: rowChunkList(records), namespace, branch });
         }
-        async mergeStream({ table, on, chunks, namespace }) {
+        async mergeStream({ table, on, chunks, namespace, branch }) {
           const input = new DatabaseWriteInputStream({
             kind: "start",
             table,
             on,
-            namespace: namespace ?? null
+            namespace: namespace ?? null,
+            branch: branch ?? null
           }, chunks);
           await this.drainWriteStream("merge", input);
         }
@@ -16389,17 +16587,28 @@ ${err.toString()}`);
             kind: "start",
             query,
             tables: normalizeTableRefs(tables),
-            params_json: params == null ? null : JSON.stringify(encodeLegacyValue(params))
+            params_json: params == null ? null : JSON.stringify(encodeDatabaseRecord(params))
           });
         }
-        async search({ table, text, vector, where, offset, limit, select, namespace }) {
+        async search({ table, text, vector, where, offset, limit, select, namespace, branch, version }) {
           const rows = [];
-          for await (const chunk of this.searchStream({ table, text, vector, where, offset, limit, select, namespace })) {
+          for await (const chunk of this.searchStream({
+            table,
+            text,
+            vector,
+            where,
+            offset,
+            limit,
+            select,
+            namespace,
+            branch,
+            version
+          })) {
             rows.push(...chunk);
           }
           return rows;
         }
-        async *searchStream({ table, text, vector, where, offset, limit, select, namespace }) {
+        async *searchStream({ table, text, vector, where, offset, limit, select, namespace, branch, version }) {
           yield* this.streamRows("search", {
             kind: "start",
             table,
@@ -16410,25 +16619,34 @@ ${err.toString()}`);
             offset: offset ?? null,
             limit: limit ?? null,
             select: select ?? null,
-            namespace: namespace ?? null
+            namespace: namespace ?? null,
+            branch: branch ?? null,
+            version: version ?? null
           });
         }
-        async count({ table, text, vector, where, namespace }) {
+        async count({ table, text, vector, where, namespace, branch, version }) {
           const response = await this.invoke("count", {
             table,
             text: text ?? null,
             vector: vector ?? null,
             text_columns: null,
             where: buildWhereClause(where),
-            namespace: namespace ?? null
+            namespace: namespace ?? null,
+            branch: branch ?? null,
+            version: version ?? null
           });
           if (!(response instanceof response_1.JsonContent) || typeof response.json.count !== "number" || !Number.isInteger(response.json.count)) {
             throw this._unexpectedResponseError("count");
           }
           return response.json.count;
         }
-        async inspect({ table, namespace }) {
-          const response = await this.invoke("inspect", { table, namespace: namespace ?? null });
+        async inspect({ table, namespace, branch, version }) {
+          const response = await this.invoke("inspect", {
+            table,
+            namespace: namespace ?? null,
+            branch: branch ?? null,
+            version: version ?? null
+          });
           if (!(response instanceof response_1.JsonContent) || !Array.isArray(response.json.fields)) {
             throw this._unexpectedResponseError("inspect");
           }
@@ -16442,57 +16660,91 @@ ${err.toString()}`);
         async optimize(tableOrParams) {
           const table = typeof tableOrParams === "string" ? tableOrParams : tableOrParams.table;
           const namespace = typeof tableOrParams === "string" ? void 0 : tableOrParams.namespace;
-          await this.room.invoke({ toolkit: "database", tool: "optimize", input: { table, namespace: namespace ?? null } });
-        }
-        async restore({ table, version, namespace }) {
+          const branch = typeof tableOrParams === "string" ? void 0 : tableOrParams.branch;
           await this.room.invoke({
             toolkit: "database",
-            tool: "restore",
-            input: { table, version, namespace: namespace ?? null }
+            tool: "optimize",
+            input: { table, namespace: namespace ?? null, branch: branch ?? null }
           });
         }
-        async checkout({ table, version, namespace }) {
+        async restore({ table, version, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
-            tool: "checkout",
-            input: { table, version, namespace: namespace ?? null }
+            tool: "restore",
+            input: { table, version, namespace: namespace ?? null, branch: branch ?? null }
           });
         }
-        async listVersions({ table, namespace }) {
-          const response = await this.invoke("list_versions", { table, namespace: namespace ?? null });
+        async listVersions({ table, namespace, branch }) {
+          const response = await this.invoke("list_versions", {
+            table,
+            namespace: namespace ?? null,
+            branch: branch ?? null
+          });
           if (!(response instanceof response_1.JsonContent) || !Array.isArray(response.json.versions)) {
             throw this._unexpectedResponseError("list_versions");
           }
           return response.json.versions.map((version) => tableVersionFromJson(version));
         }
-        async createVectorIndex({ table, column, replace = false, namespace }) {
+        async createVectorIndex({ table, column, replace = false, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
             tool: "create_vector_index",
-            input: { table, column, replace, namespace: namespace ?? null }
+            input: { table, column, replace, namespace: namespace ?? null, branch: branch ?? null }
           });
         }
-        async createScalarIndex({ table, column, replace = false, namespace }) {
+        async createScalarIndex({ table, column, replace = false, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
             tool: "create_scalar_index",
-            input: { table, column, replace, namespace: namespace ?? null }
+            input: { table, column, replace, namespace: namespace ?? null, branch: branch ?? null }
           });
         }
-        async createFullTextSearchIndex({ table, column, replace = false, namespace }) {
+        async createFullTextSearchIndex({ table, column, replace = false, namespace, branch }) {
           await this.room.invoke({
             toolkit: "database",
             tool: "create_full_text_search_index",
-            input: { table, column, replace, namespace: namespace ?? null }
+            input: { table, column, replace, namespace: namespace ?? null, branch: branch ?? null }
           });
         }
-        async listIndexes({ table, namespace }) {
-          const response = await this.invoke("list_indexes", { table, namespace: namespace ?? null });
+        async listIndexes({ table, namespace, branch, version }) {
+          const response = await this.invoke("list_indexes", {
+            table,
+            namespace: namespace ?? null,
+            branch: branch ?? null,
+            version: version ?? null
+          });
           if (!(response instanceof response_1.JsonContent) || !Array.isArray(response.json.indexes)) {
             throw this._unexpectedResponseError("list_indexes");
           }
           return response.json.indexes.map((index) => tableIndexFromJson(index));
         }
+        async listBranches({ namespace } = {}) {
+          const response = await this.invoke("list_branches", {
+            namespace: namespace ?? null
+          });
+          if (!(response instanceof response_1.JsonContent) || !Array.isArray(response.json.branches)) {
+            throw this._unexpectedResponseError("list_branches");
+          }
+          return response.json.branches.map((branch) => tableBranchFromJson(branch));
+        }
+        async createBranch({ branch, fromBranch, namespace }) {
+          await this.room.invoke({
+            toolkit: "database",
+            tool: "create_branch",
+            input: {
+              branch,
+              from_branch: fromBranch ?? null,
+              namespace: namespace ?? null
+            }
+          });
+        }
+        async deleteBranch({ branch, namespace }) {
+          await this.room.invoke({
+            toolkit: "database",
+            tool: "delete_branch",
+            input: { branch, namespace: namespace ?? null }
+          });
+        }
       };
       exports.DatabaseClient = DatabaseClient;
     }
@@ -21596,246 +21848,1050 @@ ${newlined}
     }
   });
 
+  // ../meshagent-ts/dist/browser/version.js
+  var require_version2 = __commonJS({
+    "../meshagent-ts/dist/browser/version.js"(exports) {
+      "use strict";
+      Object.defineProperty(exports, "__esModule", { value: true });
+      exports.__version__ = void 0;
+      exports.__version__ = "0.36.3";
+    }
+  });
+
   // ../meshagent-ts/dist/browser/participant-token.js
   var require_participant_token = __commonJS({
     "../meshagent-ts/dist/browser/participant-token.js"(exports) {
       "use strict";
       Object.defineProperty(exports, "__esModule", { value: true });
-      exports.ParticipantToken = exports.ParticipantGrant = exports.ApiScope = exports.SecretsGrant = exports.AdminGrant = exports.DeveloperGrant = exports.ContainersGrant = exports.StorageGrant = exports.StoragePathGrant = exports.SyncGrant = exports.SyncPathGrant = exports.DatabaseGrant = exports.TableGrant = exports.MessagingGrant = exports.QueuesGrant = exports.LivekitGrant = exports.AgentsGrant = void 0;
+      exports.ParticipantToken = exports.ParticipantGrant = exports.ApiScope = exports.LLMGrant = exports.ServicesGrant = exports.TunnelsGrant = exports.SecretsGrant = exports.OAuthEndpoint = exports.AdminGrant = exports.DeveloperGrant = exports.ContainersGrant = exports.ContainerRegistryGrant = exports.StorageGrant = exports.StoragePathGrant = exports.SyncGrant = exports.SyncPathGrant = exports.MemoryGrant = exports.MemoryEntryGrant = exports.MemoryPermissions = exports.DatabaseGrant = exports.TableGrant = exports.MessagingGrant = exports.QueuesGrant = exports.LivekitGrant = exports.AgentsGrant = void 0;
       var jose_1 = (init_webapi(), __toCommonJS(webapi_exports));
       var api_keys_1 = require_api_keys();
+      var version_1 = require_version2();
+      function matchesGrantPattern(patterns, value, allowIfUnset) {
+        if (!patterns) {
+          return allowIfUnset;
+        }
+        return patterns.some((pattern) => value === pattern || pattern.endsWith("*") && value.startsWith(pattern.slice(0, -1)));
+      }
       function getEnvValue(name) {
         if (typeof process === "undefined") {
           return void 0;
         }
         return process.env?.[name];
       }
-      var AgentsGrant = class {
-        constructor({ registerAgent, registerPublicToolkit, registerPrivateToolkit, call, useAgents, useTools } = {}) {
+      function normalizeNamespace(namespace) {
+        return namespace ?? [];
+      }
+      function namespacesEqual(left, right) {
+        const normalizedLeft = normalizeNamespace(left);
+        const normalizedRight = normalizeNamespace(right);
+        if (normalizedLeft.length !== normalizedRight.length) {
+          return false;
+        }
+        return normalizedLeft.every((value, index) => value === normalizedRight[index]);
+      }
+      function isRecord(value) {
+        return typeof value === "object" && value !== null;
+      }
+      function asStringList(value) {
+        return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : void 0;
+      }
+      var AgentsGrant = class _AgentsGrant {
+        constructor({ registerAgent, registerPublicToolkit, registerPrivateToolkit, call, useAgents, useTools, allowedToolkits } = {}) {
           this.registerAgent = registerAgent ?? true;
           this.registerPublicToolkit = registerPublicToolkit ?? true;
           this.registerPrivateToolkit = registerPrivateToolkit ?? true;
           this.call = call ?? true;
           this.useAgents = useAgents ?? true;
           this.useTools = useTools ?? true;
+          this.allowedToolkits = allowedToolkits;
+        }
+        toJSON() {
+          const json = {};
+          if (this.registerAgent !== true) {
+            json["register_agent"] = this.registerAgent;
+          }
+          if (this.registerPublicToolkit !== true) {
+            json["register_public_toolkit"] = this.registerPublicToolkit;
+          }
+          if (this.registerPrivateToolkit !== true) {
+            json["register_private_toolkit"] = this.registerPrivateToolkit;
+          }
+          if (this.call !== true) {
+            json["call"] = this.call;
+          }
+          if (this.useAgents !== true) {
+            json["use_agents"] = this.useAgents;
+          }
+          if (this.useTools !== true) {
+            json["use_tools"] = this.useTools;
+          }
+          if (this.allowedToolkits !== void 0) {
+            json["allowed_toolkits"] = this.allowedToolkits;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _AgentsGrant();
+          }
+          return new _AgentsGrant({
+            registerAgent: obj.register_agent ?? obj.registerAgent,
+            registerPublicToolkit: obj.register_public_toolkit ?? obj.registerPublicToolkit,
+            registerPrivateToolkit: obj.register_private_toolkit ?? obj.registerPrivateToolkit,
+            call: obj.call,
+            useAgents: obj.use_agents ?? obj.useAgents,
+            useTools: obj.use_tools ?? obj.useTools,
+            allowedToolkits: asStringList(obj.allowed_toolkits ?? obj.allowedToolkits)
+          });
         }
       };
       exports.AgentsGrant = AgentsGrant;
-      var LivekitGrant = class {
+      var LivekitGrant = class _LivekitGrant {
         constructor({ breakoutRooms } = {}) {
           this.breakoutRooms = breakoutRooms;
         }
         canJoinBreakoutRoom(name) {
           return !this.breakoutRooms || this.breakoutRooms.includes(name);
         }
+        toJSON() {
+          const json = {};
+          if (this.breakoutRooms !== void 0) {
+            json["breakout_rooms"] = this.breakoutRooms;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _LivekitGrant();
+          }
+          return new _LivekitGrant({
+            breakoutRooms: asStringList(obj.breakout_rooms ?? obj.breakoutRooms)
+          });
+        }
       };
       exports.LivekitGrant = LivekitGrant;
-      var QueuesGrant = class {
+      var QueuesGrant = class _QueuesGrant {
         constructor({ send, receive, list } = {}) {
-          this.list = true;
           this.send = send;
           this.receive = receive;
           this.list = list ?? true;
         }
-        canSend(q) {
-          return !this.send || this.send.includes(q);
+        canSend(queue) {
+          return !this.send || this.send.includes(queue);
+        }
+        canReceive(queue) {
+          return !this.receive || this.receive.includes(queue);
         }
-        canReceive(q) {
-          return !this.receive || this.receive.includes(q);
+        toJSON() {
+          const json = {};
+          if (this.send !== void 0) {
+            json["send"] = this.send;
+          }
+          if (this.receive !== void 0) {
+            json["receive"] = this.receive;
+          }
+          if (this.list !== true) {
+            json["list"] = this.list;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _QueuesGrant();
+          }
+          return new _QueuesGrant({
+            send: asStringList(obj.send),
+            receive: asStringList(obj.receive),
+            list: obj.list
+          });
         }
       };
       exports.QueuesGrant = QueuesGrant;
-      var MessagingGrant = class {
+      var MessagingGrant = class _MessagingGrant {
         constructor({ broadcast, list, send } = {}) {
           this.broadcast = broadcast ?? true;
           this.list = list ?? true;
           this.send = send ?? true;
         }
+        toJSON() {
+          const json = {};
+          if (this.broadcast !== true) {
+            json["broadcast"] = this.broadcast;
+          }
+          if (this.list !== true) {
+            json["list"] = this.list;
+          }
+          if (this.send !== true) {
+            json["send"] = this.send;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _MessagingGrant();
+          }
+          return new _MessagingGrant({
+            broadcast: obj.broadcast,
+            list: obj.list,
+            send: obj.send
+          });
+        }
       };
       exports.MessagingGrant = MessagingGrant;
-      var TableGrant = class {
-        constructor({ name, write, read, alter }) {
-          this.write = false;
-          this.read = true;
-          this.alter = false;
+      var TableGrant = class _TableGrant {
+        constructor({ name, namespace, write, read, alter }) {
           this.name = name;
+          this.namespace = namespace;
           this.write = write ?? false;
           this.read = read ?? true;
           this.alter = alter ?? false;
         }
+        toJSON() {
+          const json = {
+            name: this.name
+          };
+          if (this.namespace !== void 0) {
+            json["namespace"] = this.namespace;
+          }
+          if (this.write !== false) {
+            json["write"] = this.write;
+          }
+          if (this.read !== true) {
+            json["read"] = this.read;
+          }
+          if (this.alter !== false) {
+            json["alter"] = this.alter;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj) || typeof obj.name !== "string") {
+            throw new Error("TableGrant requires a name");
+          }
+          return new _TableGrant({
+            name: obj.name,
+            namespace: asStringList(obj.namespace),
+            write: obj.write,
+            read: obj.read,
+            alter: obj.alter
+          });
+        }
       };
       exports.TableGrant = TableGrant;
-      var DatabaseGrant = class {
+      var DatabaseGrant = class _DatabaseGrant {
         constructor({ tables, listTables } = {}) {
-          this.listTables = true;
           this.tables = tables;
           this.listTables = listTables ?? true;
         }
-        _match(table) {
-          if (!this.tables)
-            return void 0;
-          return this.tables.find((t) => t.name === table);
+        matchingTables(table, namespace) {
+          if (this.tables === void 0) {
+            return [];
+          }
+          return this.tables.filter((tableGrant) => {
+            if (tableGrant.name !== table) {
+              return false;
+            }
+            if (tableGrant.namespace === void 0) {
+              return true;
+            }
+            return namespacesEqual(tableGrant.namespace, namespace);
+          });
         }
-        canWrite(table) {
-          const t = this._match(table);
-          return t ? t.write : this.tables === void 0;
+        canWrite(table, namespace) {
+          if (this.tables === void 0) {
+            return true;
+          }
+          const matches = this.matchingTables(table, namespace);
+          if (matches.length === 0) {
+            return false;
+          }
+          return matches.some((tableGrant) => tableGrant.write);
+        }
+        canRead(table, namespace) {
+          if (this.tables === void 0) {
+            return true;
+          }
+          const matches = this.matchingTables(table, namespace);
+          if (matches.length === 0) {
+            return false;
+          }
+          return matches.some((tableGrant) => tableGrant.read);
+        }
+        canAlter(table, namespace) {
+          if (this.tables === void 0) {
+            return true;
+          }
+          const matches = this.matchingTables(table, namespace);
+          if (matches.length === 0) {
+            return false;
+          }
+          return matches.some((tableGrant) => tableGrant.alter);
+        }
+        canAccess(table, namespace) {
+          return this.canRead(table, namespace) || this.canWrite(table, namespace) || this.canAlter(table, namespace);
         }
-        canRead(table) {
-          const t = this._match(table);
-          return t ? t.read : this.tables === void 0;
+        toJSON() {
+          const json = {};
+          if (this.tables !== void 0) {
+            json["tables"] = this.tables.map((tableGrant) => tableGrant.toJSON());
+          }
+          if (this.listTables !== true) {
+            json["list_tables"] = this.listTables;
+          }
+          return json;
         }
-        canAlter(table) {
-          const t = this._match(table);
-          return t ? t.alter : this.tables === void 0;
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _DatabaseGrant();
+          }
+          return new _DatabaseGrant({
+            tables: Array.isArray(obj.tables) ? obj.tables.map((tableGrant) => TableGrant.fromJSON(tableGrant)) : void 0,
+            listTables: obj.list_tables ?? obj.listTables
+          });
         }
       };
       exports.DatabaseGrant = DatabaseGrant;
-      var SyncPathGrant = class {
+      var MemoryPermissions = class _MemoryPermissions {
+        constructor({ create, drop, inspect, query, upsert, ingest, recall, optimize } = {}) {
+          this.create = create ?? true;
+          this.drop = drop ?? true;
+          this.inspect = inspect ?? true;
+          this.query = query ?? true;
+          this.upsert = upsert ?? true;
+          this.ingest = ingest ?? true;
+          this.recall = recall ?? true;
+          this.optimize = optimize ?? true;
+        }
+        toJSON() {
+          const json = {};
+          if (this.create !== true) {
+            json["create"] = this.create;
+          }
+          if (this.drop !== true) {
+            json["drop"] = this.drop;
+          }
+          if (this.inspect !== true) {
+            json["inspect"] = this.inspect;
+          }
+          if (this.query !== true) {
+            json["query"] = this.query;
+          }
+          if (this.upsert !== true) {
+            json["upsert"] = this.upsert;
+          }
+          if (this.ingest !== true) {
+            json["ingest"] = this.ingest;
+          }
+          if (this.recall !== true) {
+            json["recall"] = this.recall;
+          }
+          if (this.optimize !== true) {
+            json["optimize"] = this.optimize;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _MemoryPermissions();
+          }
+          return new _MemoryPermissions({
+            create: obj.create,
+            drop: obj.drop,
+            inspect: obj.inspect,
+            query: obj.query,
+            upsert: obj.upsert,
+            ingest: obj.ingest,
+            recall: obj.recall,
+            optimize: obj.optimize
+          });
+        }
+      };
+      exports.MemoryPermissions = MemoryPermissions;
+      var MemoryEntryGrant = class _MemoryEntryGrant {
+        constructor({ name, namespace, permissions }) {
+          this.name = name;
+          this.namespace = namespace;
+          this.permissions = permissions ?? new MemoryPermissions();
+        }
+        toJSON() {
+          const json = {
+            name: this.name
+          };
+          if (this.namespace !== void 0) {
+            json["namespace"] = this.namespace;
+          }
+          json["permissions"] = this.permissions.toJSON();
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj) || typeof obj.name !== "string") {
+            throw new Error("MemoryEntryGrant requires a name");
+          }
+          return new _MemoryEntryGrant({
+            name: obj.name,
+            namespace: asStringList(obj.namespace),
+            permissions: MemoryPermissions.fromJSON(obj.permissions)
+          });
+        }
+      };
+      exports.MemoryEntryGrant = MemoryEntryGrant;
+      var MemoryGrant = class _MemoryGrant {
+        constructor({ list, memories } = {}) {
+          this.list = list ?? true;
+          this.memories = memories;
+        }
+        matchingMemories(name, namespace) {
+          if (this.memories === void 0) {
+            return [];
+          }
+          return this.memories.filter((memoryGrant) => {
+            if (memoryGrant.name !== name) {
+              return false;
+            }
+            if (memoryGrant.namespace === void 0) {
+              return true;
+            }
+            return namespacesEqual(memoryGrant.namespace, namespace);
+          });
+        }
+        can(name, namespace, permission) {
+          if (this.memories === void 0) {
+            return true;
+          }
+          const matches = this.matchingMemories(name, namespace);
+          if (matches.length === 0) {
+            return false;
+          }
+          return matches.some((memoryGrant) => memoryGrant.permissions[permission]);
+        }
+        canCreate(name, namespace) {
+          return this.can(name, namespace, "create");
+        }
+        canDrop(name, namespace) {
+          return this.can(name, namespace, "drop");
+        }
+        canInspect(name, namespace) {
+          return this.can(name, namespace, "inspect");
+        }
+        canQuery(name, namespace) {
+          return this.can(name, namespace, "query");
+        }
+        canUpsert(name, namespace) {
+          return this.can(name, namespace, "upsert");
+        }
+        canIngest(name, namespace) {
+          return this.can(name, namespace, "ingest");
+        }
+        canRecall(name, namespace) {
+          return this.can(name, namespace, "recall");
+        }
+        canOptimize(name, namespace) {
+          return this.can(name, namespace, "optimize");
+        }
+        canAccessExisting(name, namespace) {
+          return this.canDrop(name, namespace) || this.canInspect(name, namespace) || this.canQuery(name, namespace) || this.canUpsert(name, namespace) || this.canIngest(name, namespace) || this.canRecall(name, namespace) || this.canOptimize(name, namespace);
+        }
+        toJSON() {
+          const json = {};
+          if (this.list !== true) {
+            json["list"] = this.list;
+          }
+          if (this.memories !== void 0) {
+            json["memories"] = this.memories.map((memoryGrant) => memoryGrant.toJSON());
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _MemoryGrant();
+          }
+          return new _MemoryGrant({
+            list: obj.list,
+            memories: Array.isArray(obj.memories) ? obj.memories.map((memoryGrant) => MemoryEntryGrant.fromJSON(memoryGrant)) : void 0
+          });
+        }
+      };
+      exports.MemoryGrant = MemoryGrant;
+      var SyncPathGrant = class _SyncPathGrant {
         constructor({ path, readOnly }) {
           this.path = path;
           this.readOnly = readOnly ?? false;
         }
+        toJSON() {
+          const json = {
+            path: this.path
+          };
+          if (this.readOnly !== false) {
+            json["read_only"] = this.readOnly;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj) || typeof obj.path !== "string") {
+            throw new Error("SyncPathGrant requires a path");
+          }
+          return new _SyncPathGrant({
+            path: obj.path,
+            readOnly: obj.read_only ?? obj.readOnly
+          });
+        }
       };
       exports.SyncPathGrant = SyncPathGrant;
-      var SyncGrant = class {
+      var SyncGrant = class _SyncGrant {
         constructor({ paths } = {}) {
           this.paths = paths;
         }
-        matches(p, path) {
-          return p.path === path || p.path.endsWith("*") && path.startsWith(p.path.slice(0, -1));
+        matches(pathGrant, path) {
+          return pathGrant.path === path || pathGrant.path.endsWith("*") && path.startsWith(pathGrant.path.slice(0, -1));
         }
         canRead(path) {
-          if (this.paths) {
-            return this.paths.some((p) => this.matches(p, path));
+          if (this.paths === void 0) {
+            return true;
           }
-          return true;
+          return this.paths.some((pathGrant) => this.matches(pathGrant, path));
         }
         canWrite(path) {
-          if (this.paths) {
-            const p = this.paths.find((pp) => this.matches(pp, path));
-            return p ? !p.readOnly : false;
+          if (this.paths === void 0) {
+            return true;
           }
-          return true;
+          for (const pathGrant of this.paths) {
+            if (this.matches(pathGrant, path)) {
+              return !pathGrant.readOnly;
+            }
+          }
+          return false;
+        }
+        toJSON() {
+          const json = {};
+          if (this.paths !== void 0) {
+            json["paths"] = this.paths.map((pathGrant) => pathGrant.toJSON());
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _SyncGrant();
+          }
+          return new _SyncGrant({
+            paths: Array.isArray(obj.paths) ? obj.paths.map((pathGrant) => SyncPathGrant.fromJSON(pathGrant)) : void 0
+          });
         }
       };
       exports.SyncGrant = SyncGrant;
-      var StoragePathGrant = class {
+      var StoragePathGrant = class _StoragePathGrant {
         constructor({ path, readOnly }) {
           this.path = path;
           this.readOnly = readOnly ?? false;
         }
+        toJSON() {
+          const json = {
+            path: this.path
+          };
+          if (this.readOnly !== false) {
+            json["read_only"] = this.readOnly;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj) || typeof obj.path !== "string") {
+            throw new Error("StoragePathGrant requires a path");
+          }
+          return new _StoragePathGrant({
+            path: obj.path,
+            readOnly: obj.read_only ?? obj.readOnly
+          });
+        }
       };
       exports.StoragePathGrant = StoragePathGrant;
-      var StorageGrant = class {
+      var StorageGrant = class _StorageGrant {
         constructor({ paths } = {}) {
           this.paths = paths;
         }
-        matches(p, path) {
-          return path.startsWith(p.path);
-        }
         canRead(path) {
-          if (!this.paths)
+          if (this.paths === void 0) {
             return true;
-          return this.paths.some((p) => this.matches(p, path));
+          }
+          return this.paths.some((pathGrant) => path.startsWith(pathGrant.path));
         }
         canWrite(path) {
-          if (!this.paths)
+          if (this.paths === void 0) {
             return true;
-          const p = this.paths.find((pp) => this.matches(pp, path));
-          return p ? !p.readOnly : false;
+          }
+          for (const pathGrant of this.paths) {
+            if (path.startsWith(pathGrant.path)) {
+              return !pathGrant.readOnly;
+            }
+          }
+          return false;
+        }
+        toJSON() {
+          const json = {};
+          if (this.paths !== void 0) {
+            json["paths"] = this.paths.map((pathGrant) => pathGrant.toJSON());
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _StorageGrant();
+          }
+          return new _StorageGrant({
+            paths: Array.isArray(obj.paths) ? obj.paths.map((pathGrant) => StoragePathGrant.fromJSON(pathGrant)) : void 0
+          });
         }
       };
       exports.StorageGrant = StorageGrant;
-      var ContainersGrant = class {
-        constructor({ logs, pull, run, useContainers } = {}) {
-          this.logs = logs ?? true;
+      var ContainerRegistryGrant = class _ContainerRegistryGrant {
+        constructor({ list, pull, run, write } = {}) {
+          this.list = list;
           this.pull = pull;
           this.run = run;
-          this.useContainers = useContainers ?? true;
+          this.write = write;
         }
-        match(list, tag2) {
-          if (!list) {
+        canList(repository) {
+          if (this.list !== void 0) {
+            return matchesGrantPattern(this.list, repository, false);
+          }
+          if (this.pull === void 0 && this.run === void 0 && this.write === void 0) {
             return true;
           }
-          return list.some((t) => tag2 === t || tag2.startsWith(t.endsWith("*") ? t.slice(0, -1) : t));
+          return [this.pull, this.run, this.write].filter((patterns) => patterns !== void 0).some((patterns) => matchesGrantPattern(patterns, repository, false));
+        }
+        canPull(repository) {
+          return matchesGrantPattern(this.pull, repository, true);
+        }
+        canRun(repository) {
+          return matchesGrantPattern(this.run, repository, true);
+        }
+        canWrite(repository) {
+          return matchesGrantPattern(this.write, repository, true);
+        }
+        toJSON() {
+          const json = {};
+          if (this.list !== void 0) {
+            json["list"] = this.list;
+          }
+          if (this.pull !== void 0) {
+            json["pull"] = this.pull;
+          }
+          if (this.run !== void 0) {
+            json["run"] = this.run;
+          }
+          if (this.write !== void 0) {
+            json["write"] = this.write;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _ContainerRegistryGrant();
+          }
+          return new _ContainerRegistryGrant({
+            list: asStringList(obj.list),
+            pull: asStringList(obj.pull),
+            run: asStringList(obj.run),
+            write: asStringList(obj.write)
+          });
+        }
+      };
+      exports.ContainerRegistryGrant = ContainerRegistryGrant;
+      var ContainersGrant = class _ContainersGrant {
+        constructor({ logs, pull, run, registry, useContainers } = {}) {
+          this.logs = logs ?? true;
+          this.pull = pull;
+          this.run = run;
+          this.registry = registry;
+          this.useContainers = useContainers ?? true;
         }
         canPull(tag2) {
-          return this.match(this.pull, tag2);
+          return matchesGrantPattern(this.pull, tag2, true);
         }
         canRun(tag2) {
-          return this.match(this.run, tag2);
+          return matchesGrantPattern(this.run, tag2, true);
+        }
+        canRegistryList(repository) {
+          if (this.registry === void 0) {
+            return true;
+          }
+          return this.registry.canList(repository);
+        }
+        canRegistryPull(repository) {
+          if (this.registry === void 0) {
+            return true;
+          }
+          return this.registry.canPull(repository);
+        }
+        canRegistryRun(repository) {
+          if (this.registry === void 0) {
+            return true;
+          }
+          return this.registry.canRun(repository);
+        }
+        canRegistryWrite(repository) {
+          if (this.registry === void 0) {
+            return true;
+          }
+          return this.registry.canWrite(repository);
+        }
+        toJSON() {
+          const json = {};
+          if (this.logs !== true) {
+            json["logs"] = this.logs;
+          }
+          if (this.pull !== void 0) {
+            json["pull"] = this.pull;
+          }
+          if (this.run !== void 0) {
+            json["run"] = this.run;
+          }
+          if (this.registry !== void 0) {
+            json["registry"] = this.registry.toJSON();
+          }
+          if (this.useContainers !== true) {
+            json["use_containers"] = this.useContainers;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _ContainersGrant();
+          }
+          return new _ContainersGrant({
+            logs: obj.logs,
+            pull: asStringList(obj.pull),
+            run: asStringList(obj.run),
+            registry: obj.registry ? ContainerRegistryGrant.fromJSON(obj.registry) : void 0,
+            useContainers: obj.use_containers ?? obj.useContainers
+          });
         }
       };
       exports.ContainersGrant = ContainersGrant;
-      var DeveloperGrant = class {
+      var DeveloperGrant = class _DeveloperGrant {
         constructor({ logs } = {}) {
           this.logs = logs ?? true;
         }
+        toJSON() {
+          const json = {};
+          if (this.logs !== true) {
+            json["logs"] = this.logs;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _DeveloperGrant();
+          }
+          return new _DeveloperGrant({
+            logs: obj.logs
+          });
+        }
       };
       exports.DeveloperGrant = DeveloperGrant;
-      var AdminGrant = class {
+      var AdminGrant = class _AdminGrant {
+        constructor({ config } = {}) {
+          this.config = config ?? true;
+        }
+        toJSON() {
+          const json = {};
+          if (this.config !== true) {
+            json["config"] = this.config;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _AdminGrant();
+          }
+          return new _AdminGrant({
+            config: obj.config
+          });
+        }
       };
       exports.AdminGrant = AdminGrant;
-      var SecretsGrant = class {
-        canRequestOauthToken(authorizationEndpoint) {
-          if (!this.requestOauthToken) {
+      var OAuthEndpoint = class _OAuthEndpoint {
+        constructor({ endpoint, clientId }) {
+          this.endpoint = endpoint;
+          this.clientId = clientId;
+        }
+        toJSON() {
+          return {
+            endpoint: this.endpoint,
+            client_id: this.clientId
+          };
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj) || typeof obj.endpoint !== "string") {
+            throw new Error("OAuthEndpoint requires an endpoint");
+          }
+          const clientId = obj.client_id ?? obj.clientId;
+          if (typeof clientId !== "string") {
+            throw new Error("OAuthEndpoint requires a client_id");
+          }
+          return new _OAuthEndpoint({
+            endpoint: obj.endpoint,
+            clientId
+          });
+        }
+      };
+      exports.OAuthEndpoint = OAuthEndpoint;
+      var SecretsGrant = class _SecretsGrant {
+        constructor({ requestOauthToken } = {}) {
+          this.requestOauthToken = requestOauthToken;
+        }
+        canRequestOauthToken({ connector, oauth } = {}) {
+          void connector;
+          if (this.requestOauthToken === void 0) {
             return true;
           }
-          return this.requestOauthToken.some((t) => t === authorizationEndpoint || t.endsWith("*") && authorizationEndpoint.startsWith(t.slice(0, -1)));
+          const authorizationEndpoint = typeof oauth?.authorization_endpoint === "string" ? oauth.authorization_endpoint.trim() : "";
+          const clientId = typeof oauth?.client_id === "string" ? oauth.client_id.trim() : "";
+          if (authorizationEndpoint === "" || clientId === "") {
+            return false;
+          }
+          return this.requestOauthToken.some((endpointGrant) => (endpointGrant.endpoint === authorizationEndpoint || endpointGrant.endpoint.endsWith("*") && authorizationEndpoint.startsWith(endpointGrant.endpoint.slice(0, -1))) && endpointGrant.clientId === clientId);
+        }
+        toJSON() {
+          const json = {};
+          if (this.requestOauthToken !== void 0) {
+            json["request_oauth_token"] = this.requestOauthToken.map((endpointGrant) => endpointGrant.toJSON());
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _SecretsGrant();
+          }
+          const requestOauthToken = obj.request_oauth_token ?? obj.requestOauthToken;
+          return new _SecretsGrant({
+            requestOauthToken: Array.isArray(requestOauthToken) ? requestOauthToken.map((endpointGrant) => OAuthEndpoint.fromJSON(endpointGrant)) : void 0
+          });
         }
       };
       exports.SecretsGrant = SecretsGrant;
+      var TunnelsGrant = class _TunnelsGrant {
+        constructor({ ports } = {}) {
+          this.ports = ports;
+        }
+        toJSON() {
+          const json = {};
+          if (this.ports !== void 0) {
+            json["ports"] = this.ports;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _TunnelsGrant();
+          }
+          return new _TunnelsGrant({
+            ports: asStringList(obj.ports)
+          });
+        }
+      };
+      exports.TunnelsGrant = TunnelsGrant;
+      var ServicesGrant = class _ServicesGrant {
+        constructor({ list } = {}) {
+          this.list = list ?? true;
+        }
+        toJSON() {
+          const json = {};
+          if (this.list !== true) {
+            json["list"] = this.list;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _ServicesGrant();
+          }
+          return new _ServicesGrant({
+            list: obj.list
+          });
+        }
+      };
+      exports.ServicesGrant = ServicesGrant;
+      var LLMGrant = class _LLMGrant {
+        constructor({ models } = {}) {
+          this.models = models;
+        }
+        canUseProvider(provider) {
+          const normalizedProvider = provider.trim();
+          if (normalizedProvider === "") {
+            return false;
+          }
+          if (!this.models) {
+            return true;
+          }
+          const prefix = `${normalizedProvider}/`;
+          return this.models.some((pattern) => pattern.trim().startsWith(prefix));
+        }
+        canUseModel(provider, model) {
+          const normalizedProvider = provider.trim();
+          const normalizedModel = model.trim();
+          if (normalizedProvider === "" || normalizedModel === "") {
+            return false;
+          }
+          return matchesGrantPattern(this.models, `${normalizedProvider}/${normalizedModel}`, true);
+        }
+        toJSON() {
+          const json = {};
+          if (this.models !== void 0) {
+            json["models"] = this.models;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _LLMGrant();
+          }
+          return new _LLMGrant({
+            models: asStringList(obj.models)
+          });
+        }
+      };
+      exports.LLMGrant = LLMGrant;
       var ApiScope = class _ApiScope {
-        constructor({ livekit, queues, messaging, database, sync, storage, containers, developer, agents, admin, secrets } = {}) {
+        constructor({ livekit, queues, messaging, database, memory, sync, storage, containers, developer, agents, llm, admin, secrets, tunnels, services } = {}) {
           this.livekit = livekit;
           this.queues = queues;
           this.messaging = messaging;
           this.database = database;
+          this.memory = memory;
           this.sync = sync;
           this.storage = storage;
           this.containers = containers;
           this.developer = developer;
           this.agents = agents;
+          this.llm = llm;
           this.admin = admin;
           this.secrets = secrets;
-        }
-        static agentDefault() {
-          const s = new _ApiScope();
-          s.livekit = new LivekitGrant();
-          s.queues = new QueuesGrant();
-          s.messaging = new MessagingGrant();
-          s.database = new DatabaseGrant();
-          s.sync = new SyncGrant();
-          s.storage = new StorageGrant();
-          s.containers = new ContainersGrant();
-          s.developer = new DeveloperGrant();
-          s.agents = new AgentsGrant();
-          return s;
+          this.tunnels = tunnels;
+          this.services = services;
+        }
+        static agentDefault({ tunnels = false } = {}) {
+          return new _ApiScope({
+            livekit: new LivekitGrant(),
+            queues: new QueuesGrant(),
+            messaging: new MessagingGrant(),
+            database: new DatabaseGrant(),
+            memory: new MemoryGrant(),
+            sync: new SyncGrant(),
+            storage: new StorageGrant(),
+            containers: new ContainersGrant(),
+            developer: new DeveloperGrant(),
+            agents: new AgentsGrant(),
+            llm: new LLMGrant(),
+            secrets: new SecretsGrant(),
+            services: new ServicesGrant(),
+            tunnels: tunnels ? new TunnelsGrant() : void 0
+          });
         }
         static userDefault() {
-          const s = new _ApiScope();
-          s.livekit = new LivekitGrant();
-          s.queues = new QueuesGrant();
-          s.messaging = new MessagingGrant();
-          s.database = new DatabaseGrant();
-          s.sync = new SyncGrant();
-          s.storage = new StorageGrant();
-          s.containers = new ContainersGrant();
-          s.developer = new DeveloperGrant();
-          s.agents = new AgentsGrant();
-          s.secrets = new SecretsGrant();
-          return s;
+          return new _ApiScope({
+            livekit: new LivekitGrant(),
+            queues: new QueuesGrant(),
+            messaging: new MessagingGrant(),
+            database: new DatabaseGrant(),
+            memory: new MemoryGrant(),
+            sync: new SyncGrant(),
+            storage: new StorageGrant(),
+            containers: new ContainersGrant(),
+            developer: new DeveloperGrant(),
+            agents: new AgentsGrant(),
+            secrets: new SecretsGrant(),
+            services: new ServicesGrant()
+          });
         }
         static full() {
-          const s = _ApiScope.agentDefault();
-          s.admin = new AdminGrant();
-          return s;
+          return new _ApiScope({
+            livekit: new LivekitGrant(),
+            queues: new QueuesGrant(),
+            messaging: new MessagingGrant(),
+            database: new DatabaseGrant(),
+            memory: new MemoryGrant(),
+            sync: new SyncGrant(),
+            storage: new StorageGrant(),
+            containers: new ContainersGrant(),
+            developer: new DeveloperGrant(),
+            agents: new AgentsGrant(),
+            llm: new LLMGrant(),
+            admin: new AdminGrant(),
+            secrets: new SecretsGrant(),
+            tunnels: new TunnelsGrant(),
+            services: new ServicesGrant()
+          });
         }
         toJSON() {
-          return { ...this };
+          const json = {};
+          if (this.livekit !== void 0) {
+            json["livekit"] = this.livekit.toJSON();
+          }
+          if (this.queues !== void 0) {
+            json["queues"] = this.queues.toJSON();
+          }
+          if (this.messaging !== void 0) {
+            json["messaging"] = this.messaging.toJSON();
+          }
+          if (this.database !== void 0) {
+            json["database"] = this.database.toJSON();
+          }
+          if (this.memory !== void 0) {
+            json["memory"] = this.memory.toJSON();
+          }
+          if (this.sync !== void 0) {
+            json["sync"] = this.sync.toJSON();
+          }
+          if (this.storage !== void 0) {
+            json["storage"] = this.storage.toJSON();
+          }
+          if (this.containers !== void 0) {
+            json["containers"] = this.containers.toJSON();
+          }
+          if (this.developer !== void 0) {
+            json["developer"] = this.developer.toJSON();
+          }
+          if (this.agents !== void 0) {
+            json["agents"] = this.agents.toJSON();
+          }
+          if (this.llm !== void 0) {
+            json["llm"] = this.llm.toJSON();
+          }
+          if (this.admin !== void 0) {
+            json["admin"] = this.admin.toJSON();
+          }
+          if (this.secrets !== void 0) {
+            json["secrets"] = this.secrets.toJSON();
+          }
+          if (this.tunnels !== void 0) {
+            json["tunnels"] = this.tunnels.toJSON();
+          }
+          if (this.services !== void 0) {
+            json["services"] = this.services.toJSON();
+          }
+          return json;
         }
         static fromJSON(obj) {
-          return Object.assign(new _ApiScope(), obj);
+          if (!isRecord(obj)) {
+            return new _ApiScope();
+          }
+          return new _ApiScope({
+            livekit: obj.livekit ? LivekitGrant.fromJSON(obj.livekit) : void 0,
+            queues: obj.queues ? QueuesGrant.fromJSON(obj.queues) : void 0,
+            messaging: obj.messaging ? MessagingGrant.fromJSON(obj.messaging) : void 0,
+            database: obj.database ? DatabaseGrant.fromJSON(obj.database) : void 0,
+            memory: obj.memory ? MemoryGrant.fromJSON(obj.memory) : void 0,
+            sync: obj.sync ? SyncGrant.fromJSON(obj.sync) : void 0,
+            storage: obj.storage ? StorageGrant.fromJSON(obj.storage) : void 0,
+            containers: obj.containers ? ContainersGrant.fromJSON(obj.containers) : void 0,
+            developer: obj.developer ? DeveloperGrant.fromJSON(obj.developer) : void 0,
+            agents: obj.agents ? AgentsGrant.fromJSON(obj.agents) : void 0,
+            llm: obj.llm ? LLMGrant.fromJSON(obj.llm) : void 0,
+            admin: obj.admin ? AdminGrant.fromJSON(obj.admin) : void 0,
+            secrets: obj.secrets ? SecretsGrant.fromJSON(obj.secrets) : void 0,
+            tunnels: obj.tunnels ? TunnelsGrant.fromJSON(obj.tunnels) : void 0,
+            services: obj.services ? ServicesGrant.fromJSON(obj.services) : void 0
+          });
         }
       };
       exports.ApiScope = ApiScope;
@@ -21870,12 +22926,14 @@ ${newlined}
       };
       exports.ParticipantGrant = ParticipantGrant;
       function compareSemver(a, b) {
-        const pa = a.split(".").map((n) => parseInt(n, 10));
-        const pb = b.split(".").map((n) => parseInt(n, 10));
-        for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
-          const x = pa[i] || 0, y = pb[i] || 0;
-          if (x !== y)
-            return x - y;
+        const pa = a.split(".").map((value) => parseInt(value, 10));
+        const pb = b.split(".").map((value) => parseInt(value, 10));
+        for (let index = 0; index < Math.max(pa.length, pb.length); index += 1) {
+          const left = pa[index] || 0;
+          const right = pb[index] || 0;
+          if (left !== right) {
+            return left - right;
+          }
         }
         return 0;
       }
@@ -21884,14 +22942,14 @@ ${newlined}
           this.name = name;
           this.projectId = projectId;
           this.apiKeyId = apiKeyId;
-          this.version = version;
+          this.version = version ?? version_1.__version__;
           this.extra = extra ?? {};
           this.grants = grants ?? [];
         }
         get role() {
-          for (const g of this.grants) {
-            if (g.name === "role" && g.scope !== "user") {
-              return String(g.scope);
+          for (const grant of this.grants) {
+            if (grant.name === "role" && grant.scope !== "user") {
+              return String(grant.scope);
             }
           }
           return "user";
@@ -21913,8 +22971,10 @@ ${newlined}
           return true;
         }
         addTunnelGrant(ports) {
-          const portsStr = ports.join(",");
-          this.grants.push(new ParticipantGrant({ name: "tunnel_ports", scope: portsStr }));
+          this.grants.push(new ParticipantGrant({
+            name: "tunnel_ports",
+            scope: ports.join(",")
+          }));
         }
         addRoleGrant(role) {
           this.grants.push(new ParticipantGrant({ name: "role", scope: role }));
@@ -21923,125 +22983,109 @@ ${newlined}
           this.grants.push(new ParticipantGrant({ name: "room", scope: roomName }));
         }
         addApiGrant(grant) {
+          for (const existingGrant of this.grants) {
+            if (existingGrant.name === "api") {
+              throw new Error("can only have a single api grant");
+            }
+          }
           this.grants.push(new ParticipantGrant({ name: "api", scope: grant }));
         }
         grantScope(name) {
-          return this.grants.find((g) => g.name === name)?.scope;
+          return this.grants.find((grant) => grant.name === name)?.scope;
         }
         getApiGrant() {
-          const api = this.grantScope("api");
-          if (api && typeof api !== "string") {
-            return api;
-          }
-          if (this.version && compareSemver(this.version, "0.6.0") < 0 && !api) {
-            return new ApiScope({
-              livekit: new LivekitGrant(),
-              queues: new QueuesGrant(),
-              messaging: new MessagingGrant(),
-              database: new DatabaseGrant(),
-              sync: new SyncGrant(),
-              storage: new StorageGrant(),
-              agents: new AgentsGrant(),
-              developer: new DeveloperGrant()
-            });
+          const apiGrant = this.grantScope("api");
+          if (apiGrant && typeof apiGrant !== "string") {
+            return apiGrant;
           }
-          return api;
+          return void 0;
         }
         toJson() {
-          const base = {
+          const json = {
+            ...this.extra ?? {},
             name: this.name,
-            grants: this.grants.map((g) => g.toJson())
+            grants: this.grants.map((grant) => grant.toJson())
           };
-          if (this.projectId) {
-            base["sub"] = this.projectId;
+          if (this.projectId !== void 0) {
+            json["sub"] = this.projectId;
           }
-          if (this.apiKeyId) {
-            base["kid"] = this.apiKeyId;
+          if (this.apiKeyId !== void 0) {
+            json["kid"] = this.apiKeyId;
           }
-          if (this.version) {
-            base["version"] = this.version;
+          if (this.version !== void 0) {
+            json["version"] = this.version;
           }
-          return base;
+          return json;
         }
         async toJwt({ token, expiration, apiKey } = {}) {
-          let apiGrant = null;
-          for (const g of this.grants) {
-            if (g.name === "api") {
-              apiGrant = g;
-              break;
-            }
-          }
-          if (!apiGrant && this.version && compareSemver(this.version, "0.5.3") >= 0) {
-            console.error("ParticipantToken.toJwt: No API grant found, but version is >= 0.5.3. This may cause issues with older clients that expect an API grant.");
+          const apiGrant = this.grants.find((grant) => grant.name === "api");
+          if (!apiGrant && compareSemver(this.version, "0.3.5") > 0) {
+            console.warn("there is no ApiScope in the participant token, this participant will not be able to make calls to the the room API. Use addApiGrant to add an ApiScope to this token.");
           }
+          const payload = this.toJson();
+          const resolvedApiKey = apiKey ?? getEnvValue("MESHAGENT_API_KEY");
           let resolvedSecret = token;
-          let resolvedKid = this.apiKeyId;
-          let resolvedSub = this.projectId;
-          const apiKeyValue = apiKey ?? getEnvValue("MESHAGENT_API_KEY");
-          if (apiKeyValue) {
-            const parsed = (0, api_keys_1.parseApiKey)(apiKeyValue);
-            resolvedSecret ?? (resolvedSecret = parsed.secret);
-            resolvedKid = parsed.id;
-            resolvedSub = parsed.projectId;
-          }
-          let usingDefaultSecret = false;
-          if (!resolvedSecret) {
-            const envSecret = getEnvValue("MESHAGENT_SECRET");
-            if (!envSecret) {
-              throw new Error("ParticipantToken.toJwt: No secret provided. Pass `token`, `apiKey`, or set MESHAGENT_SECRET / MESHAGENT_API_KEY.");
-            }
-            resolvedSecret = envSecret;
-            usingDefaultSecret = true;
+          if (resolvedApiKey !== void 0) {
+            const parsed = (0, api_keys_1.parseApiKey)(resolvedApiKey);
+            resolvedSecret = parsed.secret;
+            payload["kid"] = parsed.id;
+            payload["sub"] = parsed.projectId;
+          } else if (resolvedSecret === void 0) {
+            delete payload["kid"];
           }
-          const secretKey = new TextEncoder().encode(resolvedSecret);
-          const payload = this.toJson();
-          if (resolvedSub) {
-            payload["sub"] = resolvedSub;
-          } else {
-            delete payload["sub"];
+          if (resolvedSecret === void 0) {
+            resolvedSecret = getEnvValue("MESHAGENT_SECRET");
           }
-          if (usingDefaultSecret) {
-            delete payload["kid"];
-          } else if (resolvedKid) {
-            payload["kid"] = resolvedKid;
-          } else {
-            delete payload["kid"];
+          if (resolvedSecret === void 0) {
+            throw new Error("ParticipantToken.toJwt: No secret provided. Pass `token`, `apiKey`, or set MESHAGENT_SECRET / MESHAGENT_API_KEY.");
           }
-          if (expiration) {
+          if (expiration !== void 0) {
             payload.exp = Math.floor(expiration.getTime() / 1e3);
           }
-          const jwt = new jose_1.SignJWT(payload).setProtectedHeader({ alg: "HS256", typ: "JWT" });
-          const jwtToken = await jwt.sign(secretKey);
-          return jwtToken;
+          const secretKey = new TextEncoder().encode(resolvedSecret);
+          return await new jose_1.SignJWT(payload).setProtectedHeader({ alg: "HS256", typ: "JWT" }).sign(secretKey);
         }
         static fromJson(json) {
-          const { name, sub, grants, kid, version, ...rest } = json;
-          const extra = { ...rest };
-          const v = version ? version : "0.5.3";
+          const data = { ...json };
+          if (typeof data.name !== "string") {
+            throw new Error(`Participant token does not have a name ${JSON.stringify(json)}`);
+          }
+          const name = data.name;
+          delete data.name;
+          const grantsRaw = Array.isArray(data.grants) ? data.grants : [];
+          delete data.grants;
+          const projectId = typeof data.sub === "string" ? data.sub : void 0;
+          delete data.sub;
+          const apiKeyId = typeof data.kid === "string" ? data.kid : void 0;
+          delete data.kid;
+          const version = typeof data.version === "string" ? data.version : version_1.__version__;
+          delete data.version;
           return new _ParticipantToken({
             name,
-            projectId: sub,
-            apiKeyId: kid,
-            version: v,
-            grants: grants?.map((g) => ParticipantGrant.fromJson(g)),
-            extra
+            projectId,
+            apiKeyId,
+            grants: grantsRaw.map((grant) => ParticipantGrant.fromJson(grant)),
+            extra: data,
+            version
           });
         }
         static async fromJwt(jwtStr, options = {}) {
-          const { token, verify: verify2 = true } = options ?? {};
+          const { token, verify: verify2 = true } = options;
           if (verify2) {
-            const secretKey = new TextEncoder().encode(token);
+            const verificationToken = token ?? getEnvValue("MESHAGENT_SECRET");
+            if (verificationToken === void 0) {
+              throw new Error("Failed to verify JWT: no token provided");
+            }
+            const secretKey = new TextEncoder().encode(verificationToken);
             const { payload } = await (0, jose_1.jwtVerify)(jwtStr, secretKey, {
               algorithms: ["HS256"]
             });
             return _ParticipantToken.fromJson(payload);
-          } else {
-            try {
-              const payload = (0, jose_1.decodeJwt)(jwtStr);
-              return _ParticipantToken.fromJson(payload);
-            } catch (err) {
-              throw new Error("Failed to decode JWT");
-            }
+          }
+          try {
+            return _ParticipantToken.fromJson((0, jose_1.decodeJwt)(jwtStr));
+          } catch {
+            throw new Error("Failed to decode JWT");
           }
         }
       };
@@ -22574,6 +23618,17 @@ ${newlined}
         }
         return bytes;
       }
+      function toFetchBody(body) {
+        if (body == null) {
+          return void 0;
+        }
+        if (typeof body === "string" || body instanceof ArrayBuffer) {
+          return body;
+        }
+        const copy = new Uint8Array(body.byteLength);
+        copy.set(body);
+        return copy.buffer;
+      }
       function normalizeBinary(data) {
         if (data instanceof Uint8Array) {
           return data;
@@ -22625,7 +23680,7 @@ ${newlined}
           const response = await fetch(url, {
             method,
             headers: finalHeaders,
-            body: requestBody ?? void 0
+            body: toFetchBody(requestBody)
           });
           if (!response.ok) {
             let message2;
@@ -26567,6 +27622,7 @@ ${newlined}
       __exportStar(require_helpers(), exports);
       __exportStar(require_tool_content_type(), exports);
       __exportStar(require_utils(), exports);
+      __exportStar(require_version2(), exports);
     }
   });