@meshagent/meshagent-ts-auth 0.44.13 → 0.45.1

package/dist/browser/ma-auth.global.js

@@ -39535,7 +39535,7 @@ ${newlined}
     "../meshagent-ts/dist/browser/participant-token.js"(exports) {
       "use strict";
       Object.defineProperty(exports, "__esModule", { value: true });
-      exports.ParticipantToken = exports.ParticipantGrant = exports.ApiScope = exports.LLMGrant = exports.ServicesGrant = exports.TunnelsGrant = exports.SecretsGrant = exports.OAuthEndpoint = exports.AdminGrant = exports.DeveloperGrant = exports.ContainersGrant = exports.ContainerRegistryGrant = exports.StorageGrant = exports.StoragePathGrant = exports.SyncGrant = exports.SyncPathGrant = exports.MemoryGrant = exports.MemoryEntryGrant = exports.MemoryPermissions = exports.DatasetGrant = exports.TableGrant = exports.MessagingGrant = exports.QueuesGrant = exports.LivekitGrant = exports.AgentsGrant = void 0;
+      exports.ParticipantToken = exports.ParticipantGrant = exports.ApiScope = exports.LLMGrant = exports.ServicesGrant = exports.TunnelsGrant = exports.SecretsGrant = exports.AdminGrant = exports.DeveloperGrant = exports.ContainersGrant = exports.ContainerRegistryGrant = exports.StorageGrant = exports.StoragePathGrant = exports.SyncGrant = exports.SyncPathGrant = exports.MemoryGrant = exports.MemoryEntryGrant = exports.MemoryPermissions = exports.SqliteGrant = exports.SqliteDatabaseGrant = exports.SqliteTableGrant = exports.DatasetGrant = exports.TableGrant = exports.MessagingGrant = exports.QueuesGrant = exports.LivekitGrant = exports.AgentsGrant = void 0;
       var jose_1 = (init_webapi(), __toCommonJS(webapi_exports));
       var api_keys_js_1 = require_api_keys();
       var version_js_1 = require_version();
@@ -39824,6 +39824,212 @@ ${newlined}
         }
       };
       exports.DatasetGrant = DatasetGrant;
+      var SqliteTableGrant = class _SqliteTableGrant {
+        constructor({ database, table, namespace, write, read, alter }) {
+          this.database = database;
+          this.table = table;
+          this.namespace = namespace;
+          this.write = write ?? true;
+          this.read = read ?? true;
+          this.alter = alter ?? false;
+        }
+        toJSON() {
+          const json = {
+            database: this.database,
+            table: this.table
+          };
+          if (this.namespace !== void 0) {
+            json["namespace"] = this.namespace;
+          }
+          if (this.write !== true) {
+            json["write"] = this.write;
+          }
+          if (this.read !== true) {
+            json["read"] = this.read;
+          }
+          if (this.alter !== false) {
+            json["alter"] = this.alter;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj) || typeof obj.database !== "string" || typeof obj.table !== "string") {
+            throw new Error("SqliteTableGrant requires database and table");
+          }
+          return new _SqliteTableGrant({
+            database: obj.database,
+            table: obj.table,
+            namespace: asStringList(obj.namespace),
+            write: obj.write,
+            read: obj.read,
+            alter: obj.alter
+          });
+        }
+      };
+      exports.SqliteTableGrant = SqliteTableGrant;
+      var SqliteDatabaseGrant = class _SqliteDatabaseGrant {
+        constructor({ name, namespace, createTable, drop, inspect, listTables, execute, tables }) {
+          this.name = name;
+          this.namespace = namespace;
+          this.createTable = createTable ?? true;
+          this.drop = drop ?? false;
+          this.inspect = inspect ?? true;
+          this.listTables = listTables ?? true;
+          this.execute = execute ?? true;
+          this.tables = tables;
+        }
+        toJSON() {
+          const json = { name: this.name };
+          if (this.namespace !== void 0) {
+            json["namespace"] = this.namespace;
+          }
+          if (this.createTable !== true) {
+            json["create_table"] = this.createTable;
+          }
+          if (this.drop !== false) {
+            json["drop"] = this.drop;
+          }
+          if (this.inspect !== true) {
+            json["inspect"] = this.inspect;
+          }
+          if (this.listTables !== true) {
+            json["list_tables"] = this.listTables;
+          }
+          if (this.execute !== true) {
+            json["execute"] = this.execute;
+          }
+          if (this.tables !== void 0) {
+            json["tables"] = this.tables.map((tableGrant) => tableGrant.toJSON());
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj) || typeof obj.name !== "string") {
+            throw new Error("SqliteDatabaseGrant requires a name");
+          }
+          return new _SqliteDatabaseGrant({
+            name: obj.name,
+            namespace: asStringList(obj.namespace),
+            createTable: obj.create_table ?? obj.createTable,
+            drop: obj.drop,
+            inspect: obj.inspect,
+            listTables: obj.list_tables ?? obj.listTables,
+            execute: obj.execute,
+            tables: Array.isArray(obj.tables) ? obj.tables.map((tableGrant) => SqliteTableGrant.fromJSON(tableGrant)) : void 0
+          });
+        }
+      };
+      exports.SqliteDatabaseGrant = SqliteDatabaseGrant;
+      var SqliteGrant = class _SqliteGrant {
+        constructor({ databases, createDatabase, listDatabases } = {}) {
+          this.databases = databases;
+          this.createDatabase = createDatabase ?? true;
+          this.listDatabases = listDatabases ?? true;
+        }
+        matchingDatabases(database, namespace) {
+          if (this.databases === void 0) {
+            return [];
+          }
+          return this.databases.filter((databaseGrant) => {
+            if (databaseGrant.name !== database) {
+              return false;
+            }
+            if (databaseGrant.namespace === void 0) {
+              return true;
+            }
+            return namespacesEqual(databaseGrant.namespace, namespace);
+          });
+        }
+        matchingTables(database, table, namespace) {
+          return this.matchingDatabases(database, namespace).flatMap((databaseGrant) => databaseGrant.tables ?? []).filter((tableGrant) => {
+            if (tableGrant.database !== database || tableGrant.table !== table) {
+              return false;
+            }
+            if (tableGrant.namespace === void 0) {
+              return true;
+            }
+            return namespacesEqual(tableGrant.namespace, namespace);
+          });
+        }
+        canCreateDatabase() {
+          return this.createDatabase;
+        }
+        canListDatabases() {
+          return this.listDatabases;
+        }
+        canDropDatabase(database, namespace) {
+          if (this.databases === void 0) {
+            return true;
+          }
+          return this.matchingDatabases(database, namespace).some((databaseGrant) => databaseGrant.drop);
+        }
+        canInspectDatabase(database, namespace) {
+          if (this.databases === void 0) {
+            return true;
+          }
+          return this.matchingDatabases(database, namespace).some((databaseGrant) => databaseGrant.inspect);
+        }
+        canListTables(database, namespace) {
+          if (this.databases === void 0) {
+            return true;
+          }
+          return this.matchingDatabases(database, namespace).some((databaseGrant) => databaseGrant.listTables);
+        }
+        canCreateTable(database, namespace) {
+          if (this.databases === void 0) {
+            return true;
+          }
+          return this.matchingDatabases(database, namespace).some((databaseGrant) => databaseGrant.createTable);
+        }
+        canExecute(database, namespace) {
+          if (this.databases === void 0) {
+            return true;
+          }
+          return this.matchingDatabases(database, namespace).some((databaseGrant) => databaseGrant.execute);
+        }
+        canWrite(database, table, namespace) {
+          if (this.databases === void 0) {
+            return true;
+          }
+          return this.matchingTables(database, table, namespace).some((tableGrant) => tableGrant.write);
+        }
+        canRead(database, table, namespace) {
+          if (this.databases === void 0) {
+            return true;
+          }
+          return this.matchingTables(database, table, namespace).some((tableGrant) => tableGrant.read);
+        }
+        canAlter(database, table, namespace) {
+          if (this.databases === void 0) {
+            return true;
+          }
+          return this.matchingTables(database, table, namespace).some((tableGrant) => tableGrant.alter);
+        }
+        toJSON() {
+          const json = {};
+          if (this.databases !== void 0) {
+            json["databases"] = this.databases.map((databaseGrant) => databaseGrant.toJSON());
+          }
+          if (this.createDatabase !== true) {
+            json["create_database"] = this.createDatabase;
+          }
+          if (this.listDatabases !== true) {
+            json["list_databases"] = this.listDatabases;
+          }
+          return json;
+        }
+        static fromJSON(obj) {
+          if (!isRecord(obj)) {
+            return new _SqliteGrant();
+          }
+          return new _SqliteGrant({
+            databases: Array.isArray(obj.databases) ? obj.databases.map((databaseGrant) => SqliteDatabaseGrant.fromJSON(databaseGrant)) : void 0,
+            createDatabase: obj.create_database ?? obj.createDatabase,
+            listDatabases: obj.list_databases ?? obj.listDatabases
+          });
+        }
+      };
+      exports.SqliteGrant = SqliteGrant;
       var MemoryPermissions = class _MemoryPermissions {
         constructor({ create, drop, inspect, query, upsert, ingest, recall, optimize } = {}) {
           this.create = create ?? true;
@@ -40281,63 +40487,25 @@ ${newlined}
         }
       };
       exports.AdminGrant = AdminGrant;
-      var OAuthEndpoint = class _OAuthEndpoint {
-        constructor({ endpoint, clientId }) {
-          this.endpoint = endpoint;
-          this.clientId = clientId;
-        }
-        toJSON() {
-          return {
-            endpoint: this.endpoint,
-            client_id: this.clientId
-          };
-        }
-        static fromJSON(obj) {
-          if (!isRecord(obj) || typeof obj.endpoint !== "string") {
-            throw new Error("OAuthEndpoint requires an endpoint");
-          }
-          const clientId = obj.client_id ?? obj.clientId;
-          if (typeof clientId !== "string") {
-            throw new Error("OAuthEndpoint requires a client_id");
-          }
-          return new _OAuthEndpoint({
-            endpoint: obj.endpoint,
-            clientId
-          });
-        }
-      };
-      exports.OAuthEndpoint = OAuthEndpoint;
       var SecretsGrant = class _SecretsGrant {
-        constructor({ requestOauthToken } = {}) {
-          this.requestOauthToken = requestOauthToken;
-        }
-        canRequestOauthToken({ connector, oauth } = {}) {
-          void connector;
-          if (this.requestOauthToken === void 0) {
-            return true;
-          }
-          const authorizationEndpoint = typeof oauth?.authorization_endpoint === "string" ? oauth.authorization_endpoint.trim() : "";
-          const clientId = typeof oauth?.client_id === "string" ? oauth.client_id.trim() : "";
-          if (authorizationEndpoint === "" || clientId === "") {
-            return false;
+        constructor(options = {}) {
+          const keys = Object.keys(options);
+          if (keys.length > 0) {
+            throw new Error(`unsupported SecretsGrant fields: ${keys.join(", ")}`);
           }
-          return this.requestOauthToken.some((endpointGrant) => (endpointGrant.endpoint === authorizationEndpoint || endpointGrant.endpoint.endsWith("*") && authorizationEndpoint.startsWith(endpointGrant.endpoint.slice(0, -1))) && endpointGrant.clientId === clientId);
         }
         toJSON() {
-          const json = {};
-          if (this.requestOauthToken !== void 0) {
-            json["request_oauth_token"] = this.requestOauthToken.map((endpointGrant) => endpointGrant.toJSON());
-          }
-          return json;
+          return {};
         }
         static fromJSON(obj) {
           if (!isRecord(obj)) {
             return new _SecretsGrant();
           }
-          const requestOauthToken = obj.request_oauth_token ?? obj.requestOauthToken;
-          return new _SecretsGrant({
-            requestOauthToken: Array.isArray(requestOauthToken) ? requestOauthToken.map((endpointGrant) => OAuthEndpoint.fromJSON(endpointGrant)) : void 0
-          });
+          const keys = Object.keys(obj);
+          if (keys.length > 0) {
+            throw new Error(`unsupported SecretsGrant fields: ${keys.join(", ")}`);
+          }
+          return new _SecretsGrant();
         }
       };
       exports.SecretsGrant = SecretsGrant;
@@ -40424,11 +40592,12 @@ ${newlined}
       };
       exports.LLMGrant = LLMGrant;
       var ApiScope = class _ApiScope {
-        constructor({ livekit, queues, messaging, dataset, memory, sync, storage, containers, developer, agents, llm, admin, secrets, tunnels, services } = {}) {
+        constructor({ livekit, queues, messaging, dataset, sqlite, memory, sync, storage, containers, developer, agents, llm, admin, secrets, tunnels, services } = {}) {
           this.livekit = livekit;
           this.queues = queues;
           this.messaging = messaging;
           this.dataset = dataset;
+          this.sqlite = sqlite;
           this.memory = memory;
           this.sync = sync;
           this.storage = storage;
@@ -40447,6 +40616,7 @@ ${newlined}
             queues: new QueuesGrant(),
             messaging: new MessagingGrant(),
             dataset: new DatasetGrant(),
+            sqlite: new SqliteGrant(),
             memory: new MemoryGrant(),
             sync: new SyncGrant(),
             storage: new StorageGrant(),
@@ -40463,6 +40633,7 @@ ${newlined}
             queues: new QueuesGrant(),
             messaging: new MessagingGrant(),
             dataset: new DatasetGrant(),
+            sqlite: new SqliteGrant(),
             memory: new MemoryGrant(),
             sync: new SyncGrant(),
             storage: new StorageGrant(),
@@ -40470,7 +40641,6 @@ ${newlined}
             developer: new DeveloperGrant(),
             agents: new AgentsGrant(),
             llm: new LLMGrant(),
-            secrets: new SecretsGrant(),
             services: new ServicesGrant()
           });
         }
@@ -40480,6 +40650,7 @@ ${newlined}
             queues: new QueuesGrant(),
             messaging: new MessagingGrant(),
             dataset: new DatasetGrant(),
+            sqlite: new SqliteGrant(),
             memory: new MemoryGrant(),
             sync: new SyncGrant(),
             storage: new StorageGrant(),
@@ -40488,7 +40659,6 @@ ${newlined}
             agents: new AgentsGrant(),
             llm: new LLMGrant(),
             admin: new AdminGrant(),
-            secrets: new SecretsGrant(),
             tunnels: new TunnelsGrant(),
             services: new ServicesGrant()
           });
@@ -40507,6 +40677,9 @@ ${newlined}
           if (this.dataset !== void 0) {
             json["dataset"] = this.dataset.toJSON();
           }
+          if (this.sqlite !== void 0) {
+            json["sqlite"] = this.sqlite.toJSON();
+          }
           if (this.memory !== void 0) {
             json["memory"] = this.memory.toJSON();
           }
@@ -40552,6 +40725,7 @@ ${newlined}
             queues: obj.queues ? QueuesGrant.fromJSON(obj.queues) : void 0,
             messaging: obj.messaging ? MessagingGrant.fromJSON(obj.messaging) : void 0,
             dataset: rawDataset ? DatasetGrant.fromJSON(rawDataset) : void 0,
+            sqlite: obj.sqlite ? SqliteGrant.fromJSON(obj.sqlite) : void 0,
             memory: obj.memory ? MemoryGrant.fromJSON(obj.memory) : void 0,
             sync: obj.sync ? SyncGrant.fromJSON(obj.sync) : void 0,
             storage: obj.storage ? StorageGrant.fromJSON(obj.storage) : void 0,
@@ -41562,12 +41736,9 @@ ${newlined}
     "../meshagent-ts/dist/browser/meshagent-client.js"(exports) {
       "use strict";
       Object.defineProperty(exports, "__esModule", { value: true });
-      exports.Meshagent = exports.ManagedAgentGrant = exports.ServiceTemplateSpec = exports.RoomSession = void 0;
-      exports.normalizeServiceSpec = normalizeServiceSpec;
+      exports.Meshagent = exports.ServiceTemplateSpec = exports.RoomSession = void 0;
       var helpers_js_1 = require_helpers();
       var requirement_js_1 = require_requirement();
-      var participant_token_js_1 = require_participant_token();
-      var utils_js_1 = require_utils();
       var RoomSession = class {
         constructor({ id, roomId, roomName, createdAt, isActive, participants, kind = "room", agentId, agentName }) {
           this.id = id;
@@ -41594,216 +41765,67 @@ ${newlined}
         }
       };
       exports.RoomSession = RoomSession;
-      function cloneJsonValue(value) {
-        if (Array.isArray(value)) {
-          return value.map((item) => cloneJsonValue(item));
-        }
-        if (value != null && typeof value === "object") {
-          const result = {};
-          for (const [key, item] of Object.entries(value)) {
-            result[key] = cloneJsonValue(item);
-          }
-          return result;
-        }
-        return value;
-      }
-      function formatTemplateString(value, values) {
-        return value.replace(/\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (token, key) => values[key] ?? token);
-      }
-      function formatJsonValue(value, values) {
+      function applyTemplateValues(value, values) {
         if (typeof value === "string") {
-          return formatTemplateString(value, values);
+          return Object.entries(values).reduce((current, [key, replacement]) => current.split(`{${key}}`).join(replacement), value);
         }
         if (Array.isArray(value)) {
-          return value.map((item) => formatJsonValue(item, values));
+          return value.map((item) => applyTemplateValues(item, values));
         }
-        if (value != null && typeof value === "object") {
+        if (value !== null && typeof value === "object") {
           const result = {};
-          for (const [key, item] of Object.entries(value)) {
-            result[key] = formatJsonValue(item, values);
+          for (const [key, entry] of Object.entries(value)) {
+            result[key] = applyTemplateValues(entry, values);
           }
           return result;
         }
         return value;
       }
-      function objectOrUndefined(value) {
-        return value != null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-      }
-      function objectArray(value) {
-        return Array.isArray(value) ? value.filter((item) => objectOrUndefined(item) !== void 0) : void 0;
-      }
-      function stringValue(value) {
-        return typeof value === "string" ? value : void 0;
-      }
-      function booleanValue(value) {
-        return typeof value === "boolean" ? value : void 0;
-      }
-      function normalizeRoomMount(value) {
-        return {
-          path: stringValue(value.path) ?? "",
-          ...stringValue(value.subpath) !== void 0 ? { subpath: stringValue(value.subpath) } : {},
-          ...booleanValue(value.read_only) !== void 0 ? { read_only: booleanValue(value.read_only) } : {}
-        };
-      }
-      function normalizeProjectMount(value) {
-        return {
-          path: stringValue(value.path) ?? "",
-          ...stringValue(value.subpath) !== void 0 ? { subpath: stringValue(value.subpath) } : {},
-          read_only: booleanValue(value.read_only) ?? true
-        };
-      }
-      function normalizeImageMount(value) {
-        return {
-          path: stringValue(value.path) ?? "",
-          ...stringValue(value.subpath) !== void 0 ? { subpath: stringValue(value.subpath) } : {},
-          read_only: booleanValue(value.read_only) ?? true,
-          image: stringValue(value.image) ?? ""
-        };
-      }
-      function normalizeFileMount(value) {
-        return {
-          path: stringValue(value.path) ?? "",
-          ...stringValue(value.subpath) !== void 0 ? { subpath: stringValue(value.subpath) } : {},
-          read_only: booleanValue(value.read_only) ?? true,
-          text: stringValue(value.text) ?? ""
-        };
-      }
-      function normalizeEmptyDirMount(value) {
-        return {
-          path: stringValue(value.path) ?? "",
-          read_only: booleanValue(value.read_only) ?? false
-        };
-      }
-      function normalizeConfigMount(value) {
-        return {
-          path: stringValue(value.path) ?? "/var/run/meshagent"
-        };
-      }
-      function normalizeContainerMountSpec(value) {
-        const source = objectOrUndefined(value) ?? {};
-        const room = objectArray(source.room)?.map(normalizeRoomMount);
-        const project = objectArray(source.project)?.map(normalizeProjectMount);
-        const images = objectArray(source.images)?.map(normalizeImageMount);
-        const files = objectArray(source.files)?.map(normalizeFileMount);
-        const emptyDirs = objectArray(source.empty_dirs)?.map(normalizeEmptyDirMount);
-        const configs = objectArray(source.configs)?.map(normalizeConfigMount);
-        return {
-          ...room !== void 0 ? { room } : {},
-          ...project !== void 0 ? { project } : {},
-          ...images !== void 0 ? { images } : {},
-          ...files !== void 0 ? { files } : {},
-          ...emptyDirs !== void 0 ? { empty_dirs: emptyDirs } : {},
-          ...configs !== void 0 ? { configs } : {}
-        };
-      }
-      function normalizeAgentSpec(agent, values) {
-        const formatted = formatJsonValue(agent, values);
-        const spec = cloneJsonValue(formatted);
-        if (spec.email != null && spec.email.public == null) {
-          spec.email = { ...spec.email, public: false };
-        }
-        if (spec.channels?.email) {
-          spec.channels = {
-            ...spec.channels,
-            email: spec.channels.email.map((channel) => ({
-              ...channel,
-              private: channel.private ?? false
-            }))
-          };
-        }
-        if (spec.channels?.messaging) {
-          spec.channels = {
-            ...spec.channels,
-            messaging: spec.channels.messaging.map((channel) => ({
+      function normalizeServiceSpec(service) {
+        const storage = service.container?.storage;
+        const agents = service.agents?.map((agent) => ({
+          ...agent,
+          email: agent.email == null ? agent.email : {
+            ...agent.email,
+            public: agent.email.public ?? false
+          },
+          channels: agent.channels == null ? agent.channels : {
+            ...agent.channels,
+            messaging: agent.channels.messaging?.map((channel) => ({
               ...channel,
               protocol: channel.protocol ?? "meshagent.agent-message.v1"
             }))
-          };
-        }
-        return spec;
-      }
-      function normalizeServiceSpec(service) {
-        const normalized = cloneJsonValue(service);
-        if (normalized.container?.storage != null) {
-          normalized.container = {
-            ...normalized.container,
-            storage: normalizeContainerMountSpec(normalized.container.storage)
-          };
-        }
-        return normalized;
+          }
+        }));
+        const container = service.container == null ? service.container : {
+          ...service.container,
+          storage: storage == null ? storage : {
+            ...storage,
+            configs: storage.configs?.map((config) => ({
+              ...config,
+              path: config.path ?? "/var/run/meshagent"
+            })),
+            files: storage.files?.map((file) => ({
+              ...file,
+              read_only: file.read_only ?? true
+            }))
+          }
+        };
+        return { ...service, agents, container };
       }
       var ServiceTemplateSpec = class _ServiceTemplateSpec {
-        constructor({ version: version2 = "v1", kind = "ServiceTemplate", variables, metadata, ports = [], container, external, agents = [] }) {
-          this.version = version2;
-          this.kind = kind;
-          this.variables = variables;
-          this.metadata = metadata;
-          this.ports = ports;
-          this.container = container;
-          this.external = external;
-          this.agents = agents;
+        constructor(template) {
+          this.template = template;
         }
         static fromJson(json) {
-          const metadata = objectOrUndefined(json.metadata);
-          if (metadata === void 0 || typeof metadata.name !== "string") {
-            throw new requirement_js_1.RoomException("Invalid service template payload: missing metadata.name");
-          }
-          return new _ServiceTemplateSpec({
-            version: stringValue(json.version) ?? "v1",
-            kind: stringValue(json.kind) ?? "ServiceTemplate",
-            variables: objectArray(json.variables),
-            metadata: cloneJsonValue(metadata),
-            ports: objectArray(json.ports) ?? [],
-            container: objectOrUndefined(json.container),
-            external: objectOrUndefined(json.external),
-            agents: objectArray(json.agents) ?? []
-          });
-        }
-        toJson() {
-          return {
-            version: this.version,
-            kind: this.kind,
-            ...this.variables != null ? { variables: cloneJsonValue(this.variables) } : {},
-            metadata: cloneJsonValue(this.metadata),
-            ...this.ports.length > 0 ? { ports: cloneJsonValue(this.ports) } : {},
-            ...this.container != null ? { container: cloneJsonValue(this.container) } : {},
-            ...this.external != null ? { external: cloneJsonValue(this.external) } : {},
-            ...this.agents.length > 0 ? { agents: cloneJsonValue(this.agents) } : {}
-          };
+          return new _ServiceTemplateSpec(json);
         }
         toServiceSpec({ values = {} } = {}) {
-          const service = {
-            version: "v1",
-            kind: "Service",
-            metadata: cloneJsonValue(this.metadata),
-            agents: this.agents.map((agent) => normalizeAgentSpec(agent, values)),
-            ports: cloneJsonValue(this.ports)
-          };
-          if (this.container != null) {
-            const formattedContainer = formatJsonValue(this.container, values);
-            const image = stringValue(formattedContainer.image);
-            if (image === void 0 || image.length === 0) {
-              throw new requirement_js_1.RoomException("ServiceTemplateSpec.image is required to build a ServiceSpec");
-            }
-            service.container = {
-              ...booleanValue(formattedContainer.private) !== void 0 ? { private: booleanValue(formattedContainer.private) } : {},
-              ...stringValue(formattedContainer.command) !== void 0 ? { command: stringValue(formattedContainer.command) } : {},
-              ...stringValue(formattedContainer.working_dir) !== void 0 ? { working_dir: stringValue(formattedContainer.working_dir) } : {},
-              image,
-              ...Array.isArray(formattedContainer.environment) ? { environment: formattedContainer.environment } : {},
-              ...objectOrUndefined(formattedContainer.storage) !== void 0 ? { storage: normalizeContainerMountSpec(formattedContainer.storage) } : {},
-              ...booleanValue(formattedContainer.on_demand) !== void 0 ? { on_demand: booleanValue(formattedContainer.on_demand) } : {},
-              ...booleanValue(formattedContainer.writable_root_fs) !== void 0 ? { writable_root_fs: booleanValue(formattedContainer.writable_root_fs) } : {}
-            };
-          }
-          if (this.external != null) {
-            const formattedExternal = formatJsonValue(this.external, values);
-            const url = stringValue(formattedExternal.url);
-            if (url !== void 0) {
-              service.external = { url };
-            }
-          }
-          return normalizeServiceSpec(service);
+          const templated = applyTemplateValues(this.template, values);
+          return normalizeServiceSpec({
+            ...templated,
+            kind: "Service"
+          });
         }
       };
       exports.ServiceTemplateSpec = ServiceTemplateSpec;
@@ -41827,26 +41849,62 @@ ${newlined}
         }
         return value;
       }
-      function pruneNullishValues(value) {
-        if (Array.isArray(value)) {
-          return value.map((item) => pruneNullishValues(item)).filter((item) => item !== void 0);
+      function validateServiceSpec(service) {
+        const container = service.container;
+        if (container == null) {
+          return;
         }
-        if (value === null || value === void 0) {
-          return void 0;
+        if (typeof container.run_as === "string") {
+          throw new Error("container.run_as must be an object with an email field");
         }
-        if (typeof value === "object") {
-          const result = {};
-          for (const [key, entryValue] of Object.entries(value)) {
-            const normalized = pruneNullishValues(entryValue);
-            if (normalized !== void 0) {
-              result[key] = normalized;
-            }
+        const environment = container.environment ?? [];
+        const hasSecretEnvironment = environment.some((entry) => entry.secret != null);
+        if (hasSecretEnvironment && container.run_as == null) {
+          throw new Error("container.run_as is required when using SecretValue");
+        }
+        for (const entry of environment) {
+          const secret = entry.secret;
+          if (secret == null) {
+            continue;
+          }
+          const unsupportedFields = Object.keys(secret).filter((key) => key !== "id");
+          if (unsupportedFields.length > 0) {
+            throw new Error(`unsupported SecretValue fields: ${unsupportedFields.join(", ")}`);
           }
-          return result;
         }
-        return value;
+        const pullSecret = container.pull_secret;
+        if (pullSecret != null) {
+          const unsupportedFields = Object.keys(pullSecret).filter((key) => key !== "id");
+          if (unsupportedFields.length > 0) {
+            throw new Error(`unsupported SecretValue fields: ${unsupportedFields.join(", ")}`);
+          }
+        }
+      }
+      var defaultServiceRunAsScopes = ["secrets:proxy"];
+      function normalizeServiceRunAs(runAs) {
+        if (runAs == null) {
+          return runAs;
+        }
+        const email = runAs.email.trim().toLowerCase();
+        if (email.length === 0) {
+          throw new Error("container.run_as.email is required");
+        }
+        const scopes = runAs.scopes == null ? defaultServiceRunAsScopes : runAs.scopes;
+        const normalizedScopes = [];
+        for (const scope of scopes) {
+          const normalized = scope.trim();
+          if (normalized.length === 0 || normalizedScopes.includes(normalized)) {
+            continue;
+          }
+          normalizedScopes.push(normalized);
+        }
+        return {
+          email,
+          scopes: normalizedScopes.length === 0 ? [...defaultServiceRunAsScopes] : normalizedScopes
+        };
       }
       function serializeServiceSpec(service) {
+        validateServiceSpec(service);
         const agents = service.agents?.map((agent) => ({
           ...agent,
           channels: agent.channels == null ? agent.channels : {
@@ -41857,8 +41915,13 @@ ${newlined}
             }))
           }
         }));
+        const container = service.container == null ? service.container : {
+          ...service.container,
+          run_as: normalizeServiceRunAs(service.container.run_as)
+        };
         return pruneUndefinedValues({
           ...service,
+          container,
           agents
         });
       }
@@ -41867,62 +41930,27 @@ ${newlined}
         delete payload.id;
         return payload;
       }
-      var ManagedAgentGrant = class _ManagedAgentGrant {
-        constructor({ admin = false } = {}) {
-          this.admin = admin;
-        }
-        static fromJson(json) {
-          return new _ManagedAgentGrant({ admin: json["admin"] === true });
+      function toFetchBody(body) {
+        if (body == null) {
+          return void 0;
         }
-        toJson() {
-          return { admin: this.admin };
-        }
-      };
-      exports.ManagedAgentGrant = ManagedAgentGrant;
-      var globalScope = globalThis;
-      function bytesToBase64(bytes) {
-        if (globalScope.Buffer) {
-          return globalScope.Buffer.from(bytes).toString("base64");
-        }
-        if (!globalScope.btoa) {
-          throw new Error("base64 encoding is not available in this runtime");
-        }
-        let binary = "";
-        for (const byte of bytes) {
-          binary += String.fromCharCode(byte);
-        }
-        return globalScope.btoa(binary);
-      }
-      function base64ToBytes(base64) {
-        if (globalScope.Buffer) {
-          return Uint8Array.from(globalScope.Buffer.from(base64, "base64"));
-        }
-        if (!globalScope.atob) {
-          throw new Error("base64 decoding is not available in this runtime");
-        }
-        const binary = globalScope.atob(base64);
-        const bytes = new Uint8Array(binary.length);
-        for (let index = 0; index < binary.length; index += 1) {
-          bytes[index] = binary.charCodeAt(index);
-        }
-        return bytes;
-      }
-      function toFetchBody(body) {
-        if (body == null) {
-          return void 0;
-        }
-        if (typeof body === "string" || body instanceof ArrayBuffer) {
-          return body;
+        if (typeof body === "string" || body instanceof ArrayBuffer) {
+          return body;
         }
         const copy = new Uint8Array(body.byteLength);
         copy.set(body);
         return copy.buffer;
       }
-      function normalizeBinary(data) {
-        if (data instanceof Uint8Array) {
-          return data;
+      function bytesToBase64(value) {
+        const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+        if (typeof Buffer !== "undefined") {
+          return Buffer.from(bytes).toString("base64");
+        }
+        let binary = "";
+        for (const byte of bytes) {
+          binary += String.fromCharCode(byte);
         }
-        return new Uint8Array(data);
+        return btoa(binary);
       }
       var Meshagent2 = class {
         constructor({ baseUrl, token } = {}) {
@@ -41978,11 +42006,10 @@ ${newlined}
             } catch {
               message2 = "<unable to read body>";
             }
-            const errorMessage = `Failed to ${action}. Status code: ${response.status}, body: ${message2}`;
             if (response.status === 403) {
-              throw new requirement_js_1.ForbiddenException(errorMessage);
+              throw new requirement_js_1.ForbiddenException(`Failed to ${action}. Status code: ${response.status}, body: ${message2}`);
             }
-            throw new requirement_js_1.RoomException(errorMessage);
+            throw new requirement_js_1.RoomException(`Failed to ${action}. Status code: ${response.status}, body: ${message2}`);
           }
           switch (responseType) {
             case "json":
@@ -41999,22 +42026,46 @@ ${newlined}
               return void 0;
           }
         }
-        parseRoomShare(data) {
-          if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid room share payload: expected object");
-          }
-          const { id, project_id: projectId, projectId: projectIdAlt, settings } = data;
-          if (typeof id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room share payload: missing id");
-          }
-          const finalProjectId = typeof projectIdAlt === "string" ? projectIdAlt : typeof projectId === "string" ? projectId : void 0;
-          if (!finalProjectId) {
-            throw new requirement_js_1.RoomException("Invalid room share payload: missing project id");
-          }
+        secretPayload(input) {
+          const payload = {};
+          if (input.projectId !== void 0)
+            payload.project_id = input.projectId;
+          if (input.name !== void 0)
+            payload.name = input.name;
+          if (input.type !== void 0)
+            payload.type = input.type;
+          if (input.httpOnly !== void 0)
+            payload.http_only = input.httpOnly;
+          if (input.metadata !== void 0)
+            payload.metadata = input.metadata;
+          if (input.annotations !== void 0)
+            payload.annotations = input.annotations;
+          return payload;
+        }
+        secretSearchPayload(input) {
+          const payload = {
+            page_size: input.pageSize ?? 100
+          };
+          if (input.filter !== void 0)
+            payload.filter = input.filter;
+          if (input.name !== void 0)
+            payload.name = input.name;
+          if (input.type !== void 0)
+            payload.type = input.type;
+          if (input.httpOnly !== void 0)
+            payload.http_only = input.httpOnly;
+          if (input.metadata !== void 0)
+            payload.metadata = input.metadata;
+          if (input.annotations !== void 0)
+            payload.annotations = input.annotations;
+          if (input.continuationToken !== void 0)
+            payload.continuation_token = input.continuationToken;
+          return payload;
+        }
+        secretVersionPayload(input) {
           return {
-            id,
-            projectId: finalProjectId,
-            settings: settings && typeof settings === "object" ? settings : {}
+            value_base64: bytesToBase64(input.value),
+            set_current: input.setCurrent ?? true
           };
         }
         parseRoomSession(data) {
@@ -42044,32 +42095,33 @@ ${newlined}
             createdAt: new Date(created),
             isActive: isActiveValue,
             participants: participants && typeof participants === "object" ? participants : void 0,
-            kind: typeof kind === "string" ? kind : "room",
+            kind: typeof kind === "string" ? kind : void 0,
             agentId: typeof agentId === "string" ? agentId : typeof agentIdRaw === "string" ? agentIdRaw : void 0,
             agentName: typeof agentName === "string" ? agentName : typeof agentNameRaw === "string" ? agentNameRaw : void 0
           });
         }
-        parseManagedAgent(data) {
+        parseRoom(data) {
           if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid managed agent payload");
+            throw new requirement_js_1.RoomException("Invalid room payload");
           }
-          const { id, name, configuration } = data;
+          const { id, name, metadata, annotations } = data;
           if (typeof id !== "string" || typeof name !== "string") {
-            throw new requirement_js_1.RoomException("Invalid managed agent payload: missing id or name");
+            throw new requirement_js_1.RoomException("Invalid room payload: missing id or name");
           }
           return {
             id,
             name,
-            configuration: configuration && typeof configuration === "object" && !Array.isArray(configuration) ? configuration : {}
+            metadata: metadata && typeof metadata === "object" ? metadata : {},
+            annotations: annotations && typeof annotations === "object" ? annotations : {}
           };
         }
-        parseRoom(data) {
+        parseGroup(data) {
           if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid room payload");
+            throw new requirement_js_1.RoomException("Invalid group payload");
           }
           const { id, name, metadata, annotations } = data;
           if (typeof id !== "string" || typeof name !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room payload: missing id or name");
+            throw new requirement_js_1.RoomException("Invalid group payload: missing id or name");
           }
           return {
             id,
@@ -42190,53 +42242,99 @@ ${newlined}
             createdAt: new Date(createdAtValue)
           };
         }
-        parseProjectRoomGrant(data) {
-          if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid room grant payload");
+        parseAccessResource(resource) {
+          if (!resource || typeof resource !== "object" || typeof resource.type !== "string" || typeof resource.id !== "string") {
+            throw new requirement_js_1.RoomException("Invalid access resource payload");
           }
-          const roomData = data.room;
-          const room = this.parseRoom(roomData);
-          const userId = data.user_id ?? data.userId;
-          if (typeof userId !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room grant payload: missing user_id");
-          }
-          const permissionsRaw = data.permissions;
-          const permissions = permissionsRaw && typeof permissionsRaw === "object" ? participant_token_js_1.ApiScope.fromJSON(permissionsRaw) : new participant_token_js_1.ApiScope();
-          return { room, userId, permissions };
+          return {
+            type: resource.type,
+            id: resource.id,
+            name: typeof resource.name === "string" ? resource.name : null,
+            metadata: resource.metadata && typeof resource.metadata === "object" ? resource.metadata : {},
+            annotations: resource.annotations && typeof resource.annotations === "object" ? resource.annotations : {}
+          };
         }
-        parseProjectRoomGrantCount(data) {
-          const roomData = data && typeof data === "object" ? data.room ?? { id: data.room_id, name: data.room_name, metadata: data.metadata ?? {} } : void 0;
-          if (!roomData) {
-            throw new requirement_js_1.RoomException("Invalid room grant count payload: missing room");
-          }
-          const room = this.parseRoom(roomData);
-          const count = data.count;
-          if (typeof count !== "number") {
-            throw new requirement_js_1.RoomException("Invalid room grant count payload: missing count");
+        parseAccessSubject(subject) {
+          if (!subject || typeof subject !== "object" || typeof subject.type !== "string" || typeof subject.id !== "string") {
+            throw new requirement_js_1.RoomException("Invalid access subject payload");
           }
-          return { room, count };
+          return {
+            type: subject.type,
+            id: subject.id,
+            name: typeof subject.name === "string" ? subject.name : null,
+            firstName: typeof subject.first_name === "string" ? subject.first_name : null,
+            lastName: typeof subject.last_name === "string" ? subject.last_name : null,
+            email: typeof subject.email === "string" ? subject.email : null,
+            objectType: typeof subject.object_type === "string" ? subject.object_type : null,
+            relation: typeof subject.relation === "string" ? subject.relation : null
+          };
+        }
+        serializeAccessSubject(subject) {
+          return {
+            type: subject.type,
+            id: subject.id,
+            ...subject.name !== void 0 ? { name: subject.name } : {},
+            ...subject.firstName !== void 0 ? { first_name: subject.firstName } : {},
+            ...subject.lastName !== void 0 ? { last_name: subject.lastName } : {},
+            ...subject.email !== void 0 ? { email: subject.email } : {},
+            ...subject.objectType !== void 0 ? { object_type: subject.objectType } : {},
+            ...subject.relation !== void 0 ? { relation: subject.relation } : {}
+          };
+        }
+        serializeAccessResource(resource) {
+          return {
+            type: resource.type,
+            id: resource.id,
+            ...resource.name !== void 0 ? { name: resource.name } : {},
+            ...resource.metadata !== void 0 ? { metadata: resource.metadata } : {},
+            ...resource.annotations !== void 0 ? { annotations: resource.annotations } : {}
+          };
         }
-        parseProjectUserGrantCount(data) {
+        parseProjectMember(data) {
           if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid room grant user count payload");
+            throw new requirement_js_1.RoomException("Invalid project member payload");
           }
-          const { user_id: userIdRaw, userId, count, first_name: firstNameRaw, firstName, last_name: lastNameRaw, lastName, email } = data;
-          const userIdValue = typeof userId === "string" ? userId : userIdRaw;
-          if (typeof userIdValue !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room grant user count payload: missing user_id");
-          }
-          if (typeof count !== "number") {
-            throw new requirement_js_1.RoomException("Invalid room grant user count payload: missing count");
+          const user = data.user && typeof data.user === "object" ? data.user : data;
+          const directRoles = Array.isArray(data.direct_roles) ? data.direct_roles.filter((item) => item === "member" || item === "admin" || item === "developer" || item === "room_creator" || item === "agent_creator" || item === "mailbox_creator" || item === "route_creator" || item === "scheduled_task_creator" || item === "llm_proxy_user" || item === "usage_reporter" || item === "billing_manager" || item === "group_manager") : [];
+          const id = typeof user.id === "string" ? user.id : "";
+          const email = typeof user.email === "string" ? user.email : "";
+          return {
+            id,
+            email,
+            firstName: typeof user.first_name === "string" ? user.first_name : null,
+            lastName: typeof user.last_name === "string" ? user.last_name : null,
+            directRoles
+          };
+        }
+        parseGroupMember(data) {
+          if (!data || typeof data !== "object") {
+            throw new requirement_js_1.RoomException("Invalid group member payload");
           }
-          if (typeof email !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room grant user count payload: missing email");
+          const directRoles = Array.isArray(data.direct_roles) ? data.direct_roles.filter((item) => item === "member" || item === "manager") : [];
+          return {
+            subject: this.parseAccessSubject(data.subject),
+            directRoles
+          };
+        }
+        parseProjectRoomGrant(data) {
+          if (!data || typeof data !== "object") {
+            throw new requirement_js_1.RoomException("Invalid room grant payload");
           }
+          const parsedResource = this.parseAccessResource(data.resource);
+          const parsedSubject = this.parseAccessSubject(data.subject);
+          const parsedDirectRoles = Array.isArray(data.direct_roles) ? data.direct_roles.filter((item) => item === "member" || item === "viewer" || item === "operator" || item === "developer" || item === "admin" || item === "room_creator" || item === "room_inventory" || item === "room_manager" || item === "session_inventory" || item === "agent_creator" || item === "agent_inventory" || item === "agent_manager" || item === "repository_creator" || item === "repository_inventory" || item === "repository_manager" || item === "feed_creator" || item === "feed_inventory" || item === "feed_manager" || item === "oauth_client_creator" || item === "oauth_client_inventory" || item === "oauth_client_manager" || item === "api_key_creator" || item === "api_key_inventory" || item === "api_key_manager" || item === "service_creator" || item === "service_inventory" || item === "service_manager" || item === "service_account_creator" || item === "service_account_inventory" || item === "service_account_manager" || item === "participant_token_creator" || item === "mailbox_creator" || item === "mailbox_inventory" || item === "mailbox_manager" || item === "route_creator" || item === "route_inventory" || item === "route_manager" || item === "scheduled_task_creator" || item === "scheduled_task_inventory" || item === "scheduled_task_manager" || item === "feed_subscription_creator" || item === "feed_subscription_inventory" || item === "feed_subscription_manager" || item === "llm_logger_creator" || item === "llm_logger_inventory" || item === "llm_logger_manager" || item === "llm_proxy_user" || item === "usage_reporter" || item === "billing_manager" || item === "group_manager" || item === "reader" || item === "subscriber" || item === "publisher" || item === "manager" || item === "list") : [];
+          const room = {
+            id: parsedResource.id,
+            name: parsedResource.name ?? parsedResource.id,
+            metadata: parsedResource.metadata ?? {},
+            annotations: parsedResource.annotations ?? {}
+          };
           return {
-            userId: userIdValue,
-            count,
-            firstName: typeof firstName === "string" ? firstName : firstNameRaw,
-            lastName: typeof lastName === "string" ? lastName : lastNameRaw,
-            email
+            resource: parsedResource,
+            subject: parsedSubject,
+            directRoles: parsedDirectRoles,
+            room,
+            userId: parsedSubject.id
           };
         }
         parseBalance(data) {
@@ -42285,179 +42383,13 @@ ${newlined}
             createdAt: new Date(createdValue)
           };
         }
-        parseSecret(data) {
-          if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid secret payload");
-          }
-          const type = data.type;
-          if (type === "docker") {
-            const server = data.server;
-            const username = data.username;
-            const password = data.password;
-            if (typeof server !== "string" || typeof username !== "string" || typeof password !== "string") {
-              throw new requirement_js_1.RoomException("Invalid docker secret payload");
-            }
-            return {
-              id: typeof data.id === "string" ? data.id : void 0,
-              name: data.name,
-              type: "docker",
-              server,
-              username,
-              password,
-              email: typeof data.email === "string" ? data.email : void 0
-            };
-          }
-          if (type === "keys") {
-            const record = data.data;
-            if (!record || typeof record !== "object") {
-              throw new requirement_js_1.RoomException("Invalid keys secret payload");
-            }
-            return {
-              id: typeof data.id === "string" ? data.id : void 0,
-              name: data.name,
-              type: "keys",
-              data: record
-            };
-          }
-          throw new requirement_js_1.RoomException(`Unknown secret type: ${type}`);
-        }
-        parseManagedSecretInfo(data) {
-          if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid managed secret payload");
-          }
-          const { id, type, name, delegated_to: delegatedToRaw, delegatedTo } = data;
-          if (typeof id !== "string" || typeof type !== "string" || typeof name !== "string") {
-            throw new requirement_js_1.RoomException("Invalid managed secret payload: missing id, type, or name");
-          }
-          const delegatedToValue = typeof delegatedTo === "string" ? delegatedTo : typeof delegatedToRaw === "string" ? delegatedToRaw : null;
-          return {
-            id,
-            type,
-            name,
-            delegatedTo: delegatedToValue
-          };
-        }
-        parseManagedSecret(data) {
-          const secret = this.parseManagedSecretInfo(data);
-          const dataBase64 = data.data_base64 ?? data.dataBase64;
-          if (typeof dataBase64 !== "string") {
-            throw new requirement_js_1.RoomException("Invalid managed secret payload: missing data_base64");
-          }
-          return {
-            ...secret,
-            dataBase64,
-            data: base64ToBytes(dataBase64)
-          };
-        }
-        parseSecretPayload(secret, rawData) {
-          let payload;
-          try {
-            payload = JSON.parse(utils_js_1.decoder.decode(rawData));
-          } catch {
-            throw new requirement_js_1.RoomException(`Invalid secret payload for ${secret.id}`);
-          }
-          if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-            throw new requirement_js_1.RoomException(`Invalid secret payload for ${secret.id}`);
-          }
-          if (secret.type === "docker") {
-            const { server, username, password, email } = payload;
-            if (typeof server !== "string" || typeof username !== "string" || typeof password !== "string") {
-              throw new requirement_js_1.RoomException(`Invalid secret payload for ${secret.id}`);
-            }
-            return {
-              id: secret.id,
-              name: secret.name,
-              type: "docker",
-              server,
-              username,
-              password,
-              email: typeof email === "string" ? email : "none@example.com"
-            };
-          }
-          const entries = Object.entries(payload);
-          if (entries.some(([, value]) => typeof value !== "string")) {
-            throw new requirement_js_1.RoomException(`Invalid secret payload for ${secret.id}`);
-          }
-          return {
-            id: secret.id,
-            name: secret.name,
-            type: "keys",
-            data: Object.fromEntries(entries)
-          };
-        }
-        toSecretPayload(secret) {
-          if (secret.type === "docker") {
-            return {
-              name: secret.name,
-              type: secret.type,
-              data: {
-                server: secret.server,
-                username: secret.username,
-                password: secret.password,
-                email: secret.email ?? "none@example.com"
-              }
-            };
-          }
-          return {
-            name: secret.name,
-            type: secret.type,
-            data: { ...secret.data }
-          };
-        }
-        parseConnectorRef(data) {
-          if (data == null) {
-            return null;
-          }
-          if (typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid connector payload");
-          }
-          const { openai_connector_id: openaiConnectorIdRaw, openaiConnectorId, server_url: serverUrlRaw, serverUrl, client_secret_id: clientSecretIdRaw, clientSecretId } = data;
-          return {
-            openaiConnectorId: typeof openaiConnectorId === "string" ? openaiConnectorId : typeof openaiConnectorIdRaw === "string" ? openaiConnectorIdRaw : null,
-            serverUrl: typeof serverUrl === "string" ? serverUrl : typeof serverUrlRaw === "string" ? serverUrlRaw : null,
-            clientSecretId: typeof clientSecretId === "string" ? clientSecretId : typeof clientSecretIdRaw === "string" ? clientSecretIdRaw : null
-          };
-        }
-        serializeConnectorRef(connector) {
-          if (connector == null) {
-            return null;
-          }
-          const payload = {};
-          if (connector.openaiConnectorId) {
-            payload.openai_connector_id = connector.openaiConnectorId;
-          }
-          if (connector.serverUrl) {
-            payload.server_url = connector.serverUrl;
-          }
-          if (connector.clientSecretId) {
-            payload.client_secret_id = connector.clientSecretId;
-          }
-          return payload;
-        }
-        parseExternalOAuthClientRegistration(data) {
-          if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid external oauth registration payload");
-          }
-          const { id, delegated_to: delegatedToRaw, delegatedTo, connector, oauth, client_id: clientIdRaw, clientId, client_secret: clientSecretRaw, clientSecret } = data;
-          const delegatedToValue = typeof delegatedTo === "string" ? delegatedTo : delegatedToRaw;
-          const clientIdValue = typeof clientId === "string" ? clientId : clientIdRaw;
-          const clientSecretValue = typeof clientSecret === "string" ? clientSecret : clientSecretRaw;
-          if (typeof id !== "string" || typeof delegatedToValue !== "string" || typeof clientIdValue !== "string") {
-            throw new requirement_js_1.RoomException("Invalid external oauth registration payload: missing fields");
-          }
-          return {
-            id,
-            delegatedTo: delegatedToValue,
-            connector: this.parseConnectorRef(connector),
-            oauth: oauth && typeof oauth === "object" ? oauth : null,
-            clientId: clientIdValue,
-            clientSecret: typeof clientSecretValue === "string" ? clientSecretValue : null
-          };
-        }
         parseOAuthClient(data) {
           if (!data || typeof data !== "object") {
             throw new requirement_js_1.RoomException("Invalid OAuth client payload");
           }
+          if ("client" in data && data.client && typeof data.client === "object") {
+            data = data.client;
+          }
           const { client_id: clientIdRaw, clientId, client_secret: clientSecretRaw, clientSecret, grant_types: grantTypesRaw, grantTypes, response_types: responseTypesRaw, responseTypes, redirect_uris: redirectUrisRaw, redirectUris, scope, project_id: projectIdRaw, projectId, metadata } = data;
           const clientIdValue = typeof clientId === "string" ? clientId : clientIdRaw;
           const clientSecretValue = typeof clientSecret === "string" ? clientSecret : clientSecretRaw;
@@ -42476,7 +42408,8 @@ ${newlined}
             redirectUris: redirectUrisValue.map(String),
             scope,
             projectId: projectIdValue,
-            metadata: metadata && typeof metadata === "object" ? metadata : {}
+            metadata: metadata && typeof metadata === "object" ? metadata : {},
+            official: Boolean(data.official)
           };
         }
         parseRoomConnectionInfo(data) {
@@ -42517,45 +42450,6 @@ ${newlined}
             responseType: "arrayBuffer"
           });
         }
-        async getProjectRole(projectId) {
-          const payload = await this.request(`/accounts/projects/${projectId}/role`, {
-            action: "fetch project role"
-          });
-          const role = payload?.role;
-          if (role !== "member" && role !== "admin" && role !== "developer") {
-            throw new requirement_js_1.RoomException("Invalid role payload");
-          }
-          return role;
-        }
-        async createShare(projectId, settings) {
-          return await this.request(`/accounts/projects/${projectId}/shares`, {
-            method: "POST",
-            json: { settings: settings ?? {} },
-            action: "create share"
-          });
-        }
-        async deleteShare(projectId, shareId) {
-          await this.request(`/accounts/projects/${projectId}/shares/${shareId}`, {
-            method: "DELETE",
-            action: "delete share",
-            responseType: "void"
-          });
-        }
-        async updateShare(projectId, shareId, settings) {
-          await this.request(`/accounts/projects/${projectId}/shares/${shareId}`, {
-            method: "PUT",
-            json: { settings: settings ?? {} },
-            action: "update share",
-            responseType: "void"
-          });
-        }
-        async listShares(projectId) {
-          const data = await this.request(`/accounts/projects/${projectId}/shares`, {
-            action: "list shares"
-          });
-          const shares = Array.isArray(data?.shares) ? data.shares : [];
-          return shares.map((item) => this.parseRoomShare(item));
-        }
         async createProject(name, settings) {
           return await this.request(`/accounts/projects`, {
             method: "POST",
@@ -42564,30 +42458,14 @@ ${newlined}
           });
         }
         async addUserToProject(projectId, userId, options = {}) {
-          const { isAdmin, isDeveloper, canCreateRooms, inviteRedirectUrl } = options;
+          const { roles = ["member"], email, inviteRedirectUrl } = options;
           return await this.request(`/accounts/projects/${projectId}/users`, {
             method: "POST",
             json: {
               project_id: projectId,
               user_id: userId,
-              ...isAdmin !== void 0 ? { is_admin: isAdmin } : {},
-              ...isDeveloper !== void 0 ? { is_developer: isDeveloper } : {},
-              ...canCreateRooms !== void 0 ? { can_create_rooms: canCreateRooms } : {},
-              ...inviteRedirectUrl !== void 0 ? { invite_redirect_url: inviteRedirectUrl } : {}
-            },
-            action: "add user to project"
-          });
-        }
-        async addUserToProjectByEmail(projectId, email, options = {}) {
-          const { isAdmin, isDeveloper, canCreateRooms, inviteRedirectUrl } = options;
-          return await this.request(`/accounts/projects/${projectId}/users`, {
-            method: "POST",
-            json: {
-              project_id: projectId,
-              email,
-              ...isAdmin !== void 0 ? { is_admin: isAdmin } : {},
-              ...isDeveloper !== void 0 ? { is_developer: isDeveloper } : {},
-              ...canCreateRooms !== void 0 ? { can_create_rooms: canCreateRooms } : {},
+              roles,
+              ...email !== void 0 ? { email } : {},
               ...inviteRedirectUrl !== void 0 ? { invite_redirect_url: inviteRedirectUrl } : {}
             },
             action: "add user to project"
@@ -42606,18 +42484,25 @@ ${newlined}
             action: "update project settings"
           });
         }
+        async updateUserInProject(projectId, userId, roles) {
+          return await this.request(`/accounts/projects/${projectId}/users/${userId}`, {
+            method: "PUT",
+            json: { roles },
+            action: "update project user"
+          });
+        }
         async getUsersInProjectPage(projectId, options = {}) {
-          const { count = 100, offset = 0, filter } = options;
+          const { pageSize = 100, continuationToken, filter, email } = options;
           const data = await this.request(`/accounts/projects/${projectId}/users`, {
-            query: { count, offset, filter },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter, email },
             action: "fetch project users"
           });
           const users = Array.isArray(data?.users) ? data.users : [];
-          return { users, total: typeof data?.total === "number" ? data.total : users.length };
+          return { users: users.map((user) => this.parseProjectMember(user)), continuationToken: data?.continuation_token ?? null };
         }
         async getUsersInProject(projectId) {
           const page = await this.getUsersInProjectPage(projectId);
-          return { users: page.users, total: page.total };
+          return page.users;
         }
         async getUserProfile(userId) {
           return await this.request(`/accounts/profiles/${userId}`, {
@@ -42646,96 +42531,291 @@ ${newlined}
             action: "get project by key"
           });
         }
-        async createAgent(params) {
-          const { projectId, configuration, ifNotExists = false, permissions } = params;
-          const permissionsJson = permissions == null ? void 0 : Object.fromEntries(Object.entries(permissions).map(([userId, grant]) => [userId, grant.toJson()]));
-          const data = await this.request(`/accounts/projects/${this.encodePathComponent(projectId)}/agents`, {
+        async listServiceAccounts(projectId, options = {}) {
+          const params = new URLSearchParams();
+          if (options.pageSize !== void 0)
+            params.set("page_size", String(options.pageSize));
+          if (options.continuationToken !== void 0)
+            params.set("continuation_token", options.continuationToken);
+          if (options.filter !== void 0)
+            params.set("filter", options.filter);
+          if (options.view !== void 0)
+            params.set("view", options.view);
+          const query = params.toString();
+          return await this.request(`/accounts/projects/${projectId}/service-accounts${query ? `?${query}` : ""}`, {
+            action: "list service accounts"
+          });
+        }
+        async createServiceAccount(projectId, name, options = {}) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts`, {
             method: "POST",
-            json: {
-              configuration: pruneNullishValues(configuration),
-              if_not_exists: ifNotExists,
-              ...permissionsJson !== void 0 ? { permissions: permissionsJson } : {}
-            },
-            action: "create agent"
+            json: { name, ...options },
+            action: "create service account"
+          });
+        }
+        async mintParticipantToken(projectId, options) {
+          const json = options.grants !== void 0 ? { name: options.name, grants: options.grants } : {
+            name: options.name,
+            room_name: options.roomName,
+            role: options.role,
+            api: options.api
+          };
+          const data = await this.request(`/accounts/projects/${projectId}/participant-tokens`, {
+            method: "POST",
+            json,
+            action: "mint participant token"
           });
-          return this.parseManagedAgent(data);
+          if (typeof data?.token !== "string" || data.token.trim() === "") {
+            throw new Error("Invalid participant token mint response");
+          }
+          return data.token;
         }
-        async createApiKey(projectId, name, description) {
-          return await this.request(`/accounts/projects/${projectId}/api-keys`, {
+        async createApiKey(projectId, serviceAccountId, name, description) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/api-keys`, {
             method: "POST",
             json: { name, description },
             action: "create api key"
           });
         }
-        async deleteApiKey(projectId, id) {
-          await this.request(`/accounts/projects/${projectId}/api-keys/${id}`, {
+        async deleteApiKey(projectId, serviceAccountId, id) {
+          await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/api-keys/${id}`, {
             method: "DELETE",
             action: "delete api key",
             responseType: "void"
           });
         }
-        async listApiKeys(projectId) {
-          return await this.request(`/accounts/projects/${projectId}/api-keys`, {
+        async revokeApiKeysByMsid(projectId, serviceAccountId, msid) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/api-keys:revoke`, {
+            method: "POST",
+            json: { msid },
+            action: "revoke api keys"
+          });
+        }
+        async listApiKeys(projectId, serviceAccountId) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/api-keys`, {
             action: "list api keys"
           });
         }
-        async getPricing() {
-          return await this.request(`/pricing`, {
-            action: "fetch pricing data"
+        async createUserSecret(input) {
+          return await this.request(`/accounts/users/me/secrets`, {
+            method: "POST",
+            json: this.secretPayload(input),
+            action: "create user secret"
           });
         }
-        async getStatus(projectId) {
-          const data = await this.request(`/accounts/projects/${projectId}/status`, {
-            action: "fetch project status"
+        async listUserSecrets(options = {}) {
+          return await this.request(`/accounts/users/me/secrets`, {
+            query: {
+              page_size: options.pageSize ?? 100,
+              continuation_token: options.continuationToken,
+              filter: options.filter
+            },
+            action: "list user secrets"
           });
-          const enabled = data?.["enabled"];
-          if (typeof enabled !== "boolean") {
-            throw new requirement_js_1.RoomException("Invalid status payload: expected boolean 'enabled'");
-          }
-          return enabled;
         }
-        async getBalance(projectId) {
-          const data = await this.request(`/accounts/projects/${projectId}/balance`, {
-            action: "fetch balance"
+        async searchUserSecrets(input = {}) {
+          return await this.request(`/accounts/users/me/secrets:search`, {
+            method: "POST",
+            json: this.secretSearchPayload(input),
+            action: "search user secrets"
           });
-          return this.parseBalance(data);
         }
-        async getRecentTransactions(projectId) {
-          const data = await this.request(`/accounts/projects/${projectId}/transactions`, {
-            action: "fetch transactions"
+        async getUserSecret(secretId, options = {}) {
+          return await this.request(`/accounts/users/me/secrets/${secretId}`, {
+            query: {
+              include_value: options.includeValue ? "true" : void 0
+            },
+            action: "get user secret"
           });
-          const list = Array.isArray(data?.transactions) ? data.transactions : [];
-          return list.map((item) => this.parseTransaction(item));
         }
-        async setAutoRecharge({ projectId, enabled, amount, threshold, monthlyBudget = null }) {
-          await this.request(`/accounts/projects/${projectId}/recharge`, {
-            method: "POST",
-            json: { enabled, amount, threshold, monthly_budget: monthlyBudget },
-            action: "update auto recharge settings",
+        async updateUserSecret(secretId, input) {
+          return await this.request(`/accounts/users/me/secrets/${secretId}`, {
+            method: "PATCH",
+            json: this.secretPayload(input),
+            action: "update user secret"
+          });
+        }
+        async deleteUserSecret(secretId) {
+          await this.request(`/accounts/users/me/secrets/${secretId}`, {
+            method: "DELETE",
+            action: "delete user secret",
             responseType: "void"
           });
         }
-        async getCheckoutUrl(projectId, { successUrl, cancelUrl }) {
-          const data = await this.request(`/accounts/projects/${projectId}/subscription`, {
-            method: "POST",
-            json: { success_url: successUrl, cancel_url: cancelUrl },
-            action: "create subscription checkout"
+        async listUserSecretVersions(secretId) {
+          const page = await this.request(`/accounts/users/me/secrets/${secretId}/versions`, {
+            action: "list user secret versions"
           });
-          const url = data?.["checkout_url"];
-          if (typeof url !== "string") {
-            throw new requirement_js_1.RoomException("Invalid subscription payload: expected 'checkout_url' string");
-          }
-          return url;
+          return page.versions;
         }
-        async getCreditsCheckoutUrl(projectId, { successUrl, cancelUrl, quantity }) {
-          const data = await this.request(`/accounts/projects/${projectId}/credits`, {
+        async createUserSecretVersion(secretId, input) {
+          return await this.request(`/accounts/users/me/secrets/${secretId}/versions`, {
             method: "POST",
-            json: { success_url: successUrl, cancel_url: cancelUrl, quantity },
-            action: "create credits checkout"
+            json: this.secretVersionPayload(input),
+            action: "create user secret version"
           });
-          const url = data?.["checkout_url"];
-          if (typeof url !== "string") {
-            throw new requirement_js_1.RoomException("Invalid credits payload: expected 'checkout_url' string");
+        }
+        async listUserSecretProxyAccess(secretId, options = {}) {
+          return await this.request(`/accounts/users/me/secrets/${secretId}/access`, {
+            query: {
+              page_size: options.pageSize ?? 100,
+              continuation_token: options.continuationToken
+            },
+            action: "list user secret proxy access"
+          });
+        }
+        async grantUserSecretProxyAccess(secretId, serviceAccountId) {
+          await this.request(`/accounts/users/me/secrets/${secretId}/access:grant-proxy`, {
+            method: "POST",
+            json: { subject: { type: "service_account", id: serviceAccountId } },
+            action: "grant user secret proxy access",
+            responseType: "void"
+          });
+        }
+        async revokeUserSecretProxyAccess(secretId, serviceAccountId) {
+          await this.request(`/accounts/users/me/secrets/${secretId}/access:revoke-proxy`, {
+            method: "POST",
+            json: { subject: { type: "service_account", id: serviceAccountId } },
+            action: "revoke user secret proxy access",
+            responseType: "void"
+          });
+        }
+        async createServiceAccountSecret(projectId, serviceAccountId, input) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets`, {
+            method: "POST",
+            json: this.secretPayload(input),
+            action: "create service account secret"
+          });
+        }
+        async listServiceAccountSecrets(projectId, serviceAccountId, options = {}) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets`, {
+            query: {
+              page_size: options.pageSize ?? 100,
+              continuation_token: options.continuationToken,
+              filter: options.filter
+            },
+            action: "list service account secrets"
+          });
+        }
+        async searchServiceAccountSecrets(projectId, serviceAccountId, input = {}) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets:search`, {
+            method: "POST",
+            json: this.secretSearchPayload(input),
+            action: "search service account secrets"
+          });
+        }
+        async getServiceAccountSecret(projectId, serviceAccountId, secretId, options = {}) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}`, {
+            query: {
+              include_value: options.includeValue ? "true" : void 0
+            },
+            action: "get service account secret"
+          });
+        }
+        async updateServiceAccountSecret(projectId, serviceAccountId, secretId, input) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}`, {
+            method: "PATCH",
+            json: this.secretPayload(input),
+            action: "update service account secret"
+          });
+        }
+        async deleteServiceAccountSecret(projectId, serviceAccountId, secretId) {
+          await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}`, {
+            method: "DELETE",
+            action: "delete service account secret",
+            responseType: "void"
+          });
+        }
+        async listServiceAccountSecretVersions(projectId, serviceAccountId, secretId) {
+          const page = await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}/versions`, {
+            action: "list service account secret versions"
+          });
+          return page.versions;
+        }
+        async createServiceAccountSecretVersion(projectId, serviceAccountId, secretId, input) {
+          return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}/versions`, {
+            method: "POST",
+            json: this.secretVersionPayload(input),
+            action: "create service account secret version"
+          });
+        }
+        async listServiceAccountPullSecrets(projectId, serviceAccountId) {
+          const page = await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/pull-secrets`, {
+            action: "list service account pull secrets"
+          });
+          return page.secrets;
+        }
+        async addServiceAccountPullSecret(projectId, serviceAccountId, secretId) {
+          await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/pull-secrets/${secretId}`, {
+            method: "PUT",
+            action: "add service account pull secret",
+            responseType: "void"
+          });
+        }
+        async removeServiceAccountPullSecret(projectId, serviceAccountId, secretId) {
+          await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/pull-secrets/${secretId}`, {
+            method: "DELETE",
+            action: "remove service account pull secret",
+            responseType: "void"
+          });
+        }
+        async getPricing() {
+          return await this.request(`/pricing`, {
+            action: "fetch pricing data"
+          });
+        }
+        async getStatus(projectId) {
+          const data = await this.request(`/accounts/projects/${projectId}/status`, {
+            action: "fetch project status"
+          });
+          const enabled = data?.["enabled"];
+          if (typeof enabled !== "boolean") {
+            throw new requirement_js_1.RoomException("Invalid status payload: expected boolean 'enabled'");
+          }
+          return enabled;
+        }
+        async getBalance(projectId) {
+          const data = await this.request(`/accounts/projects/${projectId}/balance`, {
+            action: "fetch balance"
+          });
+          return this.parseBalance(data);
+        }
+        async getRecentTransactions(projectId) {
+          const data = await this.request(`/accounts/projects/${projectId}/transactions`, {
+            action: "fetch transactions"
+          });
+          const list = Array.isArray(data?.transactions) ? data.transactions : [];
+          return list.map((item) => this.parseTransaction(item));
+        }
+        async setAutoRecharge({ projectId, enabled, amount, threshold, monthlyBudget = null }) {
+          await this.request(`/accounts/projects/${projectId}/recharge`, {
+            method: "POST",
+            json: { enabled, amount, threshold, monthly_budget: monthlyBudget },
+            action: "update auto recharge settings",
+            responseType: "void"
+          });
+        }
+        async getCheckoutUrl(projectId, { successUrl, cancelUrl }) {
+          const data = await this.request(`/accounts/projects/${projectId}/subscription`, {
+            method: "POST",
+            json: { success_url: successUrl, cancel_url: cancelUrl },
+            action: "create subscription checkout"
+          });
+          const url = data?.["checkout_url"];
+          if (typeof url !== "string") {
+            throw new requirement_js_1.RoomException("Invalid subscription payload: expected 'checkout_url' string");
+          }
+          return url;
+        }
+        async getCreditsCheckoutUrl(projectId, { successUrl, cancelUrl, quantity }) {
+          const data = await this.request(`/accounts/projects/${projectId}/credits`, {
+            method: "POST",
+            json: { success_url: successUrl, cancel_url: cancelUrl, quantity },
+            action: "create credits checkout"
+          });
+          const url = data?.["checkout_url"];
+          if (typeof url !== "string") {
+            throw new requirement_js_1.RoomException("Invalid credits payload: expected 'checkout_url' string");
           }
           return url;
         }
@@ -42787,6 +42867,40 @@ ${newlined}
           const sessions = Array.isArray(data?.sessions) ? data.sessions : [];
           return sessions.map((item) => this.parseRoomSession(item));
         }
+        async listRecentRoomSessions(projectId, roomName, options = {}) {
+          const params = new URLSearchParams();
+          if (options.limit !== void 0) {
+            params.set("limit", String(options.limit));
+          }
+          const query = params.size > 0 ? `?${params.toString()}` : "";
+          const data = await this.request(`/accounts/projects/${projectId}/rooms/${encodeURIComponent(roomName)}/sessions${query}`, { action: "list recent room sessions" });
+          const sessions = Array.isArray(data?.sessions) ? data.sessions : [];
+          return sessions.map((item) => this.parseRoomSession(item));
+        }
+        async listRecentSingleAgentSessions(projectId, agentName, options = {}) {
+          const params = new URLSearchParams();
+          if (options.limit !== void 0) {
+            params.set("limit", String(options.limit));
+          }
+          const query = params.size > 0 ? `?${params.toString()}` : "";
+          const data = await this.request(`/accounts/projects/${projectId}/agents/${encodeURIComponent(agentName)}/sessions${query}`, { action: "list recent agent sessions" });
+          const sessions = Array.isArray(data?.sessions) ? data.sessions : [];
+          return sessions.map((item) => this.parseRoomSession(item));
+        }
+        async createAgent(params) {
+          const body = {
+            configuration: params.configuration,
+            if_not_exists: params.ifNotExists ?? false
+          };
+          if (params.permissions != null) {
+            body.permissions = params.permissions;
+          }
+          return await this.request(`/accounts/projects/${params.projectId}/agents`, {
+            method: "POST",
+            json: body,
+            action: "create agent"
+          });
+        }
         async listSessionEvents(projectId, sessionId) {
           const data = await this.request(`/accounts/projects/${projectId}/sessions/${sessionId}/events`, {
             action: "list session events"
@@ -42815,34 +42929,6 @@ ${newlined}
           const metrics = data?.["metrics"];
           return Array.isArray(metrics) ? metrics : [];
         }
-        async createWebhook(projectId, params) {
-          const { name, url, events, description = "", action: webhookAction = "", payload = null } = params;
-          return await this.request(`/accounts/projects/${projectId}/webhooks`, {
-            method: "POST",
-            json: { name, description, url, events, action: webhookAction, payload },
-            action: "create webhook"
-          });
-        }
-        async updateWebhook(projectId, webhookId, params) {
-          const { name, url, events, description = "", action: webhookAction = null, payload = null } = params;
-          return await this.request(`/accounts/projects/${projectId}/webhooks/${webhookId}`, {
-            method: "PUT",
-            json: { name, description, url, events, action: webhookAction, payload },
-            action: "update webhook"
-          });
-        }
-        async listWebhooks(projectId) {
-          return await this.request(`/accounts/projects/${projectId}/webhooks`, {
-            action: "list webhooks"
-          });
-        }
-        async deleteWebhook(projectId, webhookId) {
-          await this.request(`/accounts/projects/${projectId}/webhooks/${webhookId}`, {
-            method: "DELETE",
-            action: "delete webhook",
-            responseType: "void"
-          });
-        }
         async createMailbox(params) {
           const { projectId, address, room, queue, isPublic } = params;
           await this.request(`/accounts/projects/${projectId}/mailboxes`, {
@@ -42875,18 +42961,24 @@ ${newlined}
           return { address, room, roomId: room_id, queue };
         }
         async listMailboxesPage(projectId, options = {}) {
-          const { count = 100, offset = 0, filter } = options;
+          const { pageSize = 100, continuationToken, filter } = options;
           const data = await this.request(`/accounts/projects/${projectId}/mailboxes`, {
-            query: { count, offset, filter },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter },
             action: "list mailboxes"
           });
           const mailboxes = Array.isArray(data?.mailboxes) ? data.mailboxes : [];
           const parsed = mailboxes.map((item) => this.parseMailbox(item));
-          return { mailboxes: parsed, total: typeof data?.total === "number" ? data.total : parsed.length };
+          return { mailboxes: parsed, total: typeof data?.total === "number" ? data.total : parsed.length, continuationToken: data.continuation_token ?? null };
         }
         async listMailboxes(projectId, options = {}) {
-          const page = await this.listMailboxesPage(projectId, options);
-          return page.mailboxes;
+          const mailboxes = [];
+          let continuationToken;
+          do {
+            const page = await this.listMailboxesPage(projectId, { ...options, continuationToken });
+            mailboxes.push(...page.mailboxes);
+            continuationToken = page.continuationToken ?? void 0;
+          } while (continuationToken);
+          return mailboxes;
         }
         async deleteMailbox(projectId, address) {
           await this.request(`/accounts/projects/${projectId}/mailboxes/${address}`, {
@@ -42933,18 +43025,24 @@ ${newlined}
           return this.parseFeed(data.feed);
         }
         async listFeedsPage(projectId, options = {}) {
-          const { count = 100, offset = 0, filter } = options;
+          const { pageSize = 100, continuationToken, filter, view } = options;
           const data = await this.request(`/accounts/projects/${projectId}/feeds`, {
-            query: { count, offset, filter },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter, view },
             action: "list feeds"
           });
           const feeds = Array.isArray(data?.feeds) ? data.feeds : [];
           const parsed = feeds.map((item) => this.parseFeed(item));
-          return { feeds: parsed, total: typeof data?.total === "number" ? data.total : parsed.length };
+          return { feeds: parsed, total: typeof data?.total === "number" ? data.total : parsed.length, continuationToken: data.continuation_token ?? null };
         }
         async listFeeds(projectId, options = {}) {
-          const page = await this.listFeedsPage(projectId, options);
-          return page.feeds;
+          const feeds = [];
+          let continuationToken;
+          do {
+            const page = await this.listFeedsPage(projectId, { ...options, continuationToken });
+            feeds.push(...page.feeds);
+            continuationToken = page.continuationToken ?? void 0;
+          } while (continuationToken);
+          return feeds;
         }
         async listRoomFeedsPage(projectId, roomName, options = {}) {
           const { count = 100, offset = 0, filter } = options;
@@ -43103,12 +43201,28 @@ ${newlined}
           });
           return this.parseProjectRepository(data);
         }
-        async listRepositories(projectId) {
+        async listRepositoriesPage(projectId, options = {}) {
+          const { pageSize = 100, view, continuationToken } = options;
           const data = await this.request(`/accounts/projects/${projectId}/repositories`, {
+            query: { page_size: pageSize, view, continuation_token: continuationToken },
             action: "list repositories"
           });
           const repositories = Array.isArray(data?.repositories) ? data.repositories : [];
-          return repositories.map((item) => this.parseProjectRepository(item));
+          return {
+            repositories: repositories.map((item) => this.parseProjectRepository(item)),
+            total: Number(data.total ?? repositories.length),
+            continuationToken: data.continuation_token ?? null
+          };
+        }
+        async listRepositories(projectId, options = {}) {
+          const repositories = [];
+          let continuationToken;
+          do {
+            const page = await this.listRepositoriesPage(projectId, { view: options.view, continuationToken });
+            repositories.push(...page.repositories);
+            continuationToken = page.continuationToken ?? void 0;
+          } while (continuationToken);
+          return repositories;
         }
         async deleteRepository(projectId, repositoryId) {
           await this.request(`/accounts/projects/${projectId}/repositories/${repositoryId}`, {
@@ -43198,279 +43312,14 @@ ${newlined}
             responseType: "void"
           });
         }
-        async createProjectSecret(params) {
-          const { projectId, name, type, data } = params;
-          const payload = await this.request(`/accounts/projects/${projectId}/secrets`, {
-            method: "POST",
-            json: {
-              name,
-              type,
-              data_base64: bytesToBase64(normalizeBinary(data))
-            },
-            action: "create project secret"
-          });
-          if (!payload || typeof payload !== "object" || typeof payload.id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid create project secret response payload");
-          }
-          return payload.id;
-        }
-        async updateProjectSecret(params) {
-          const { projectId, secretId, name, type, data } = params;
-          await this.request(`/accounts/projects/${projectId}/secrets/${secretId}`, {
-            method: "PUT",
-            json: {
-              name,
-              type,
-              data_base64: bytesToBase64(normalizeBinary(data))
-            },
-            action: "update project secret",
-            responseType: "void"
-          });
-        }
-        async getProjectSecret(projectId, secretId) {
-          const data = await this.request(`/accounts/projects/${projectId}/secrets/${secretId}`, {
-            action: "fetch project secret"
-          });
-          return this.parseManagedSecret(data);
-        }
-        async listProjectSecrets(projectId) {
-          const data = await this.request(`/accounts/projects/${projectId}/secrets`, {
-            action: "list project secrets"
-          });
-          const secrets = Array.isArray(data?.secrets) ? data.secrets : [];
-          return secrets.map((item) => this.parseManagedSecretInfo(item));
-        }
-        async deleteProjectSecret(projectId, secretId) {
-          await this.request(`/accounts/projects/${projectId}/secrets/${secretId}`, {
-            method: "DELETE",
-            action: "delete project secret",
-            responseType: "void"
-          });
-        }
-        async createRoomSecret(params) {
-          const { projectId, roomName, data, secretId, name, type, delegatedTo, forIdentity } = params;
-          const payload = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets`, {
-            method: "POST",
-            json: {
-              data_base64: bytesToBase64(normalizeBinary(data)),
-              secret_id: secretId,
-              name,
-              type,
-              delegated_to: delegatedTo,
-              for_identity: forIdentity
-            },
-            action: "create room secret"
-          });
-          if (!payload || typeof payload !== "object" || typeof payload.id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid create room secret response payload");
-          }
-          return payload.id;
-        }
-        async updateRoomSecret(params) {
-          const { projectId, roomName, secretId, data, name, type, delegatedTo, forIdentity } = params;
-          await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets/${secretId}`, {
-            method: "PUT",
-            json: {
-              data_base64: bytesToBase64(normalizeBinary(data)),
-              name,
-              type,
-              delegated_to: delegatedTo,
-              for_identity: forIdentity
-            },
-            action: "update room secret",
-            responseType: "void"
-          });
-        }
-        async getRoomSecret(params) {
-          const { projectId, roomName, secretId, delegatedTo, forIdentity } = params;
-          const data = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets/${secretId}`, {
-            query: {
-              delegated_to: delegatedTo,
-              for_identity: forIdentity
-            },
-            action: "fetch room secret"
-          });
-          return this.parseManagedSecret(data);
-        }
-        async listRoomSecrets(params) {
-          const { projectId, roomName, forIdentity } = params;
-          const data = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets`, {
-            query: {
-              for_identity: forIdentity
-            },
-            action: "list room secrets"
-          });
-          const secrets = Array.isArray(data?.secrets) ? data.secrets : [];
-          return secrets.map((item) => this.parseManagedSecretInfo(item));
-        }
-        async deleteRoomSecret(params) {
-          const { projectId, roomName, secretId, delegatedTo, forIdentity } = params;
-          await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets/${secretId}`, {
-            method: "DELETE",
-            query: {
-              delegated_to: delegatedTo,
-              for_identity: forIdentity
-            },
-            action: "delete room secret",
-            responseType: "void"
-          });
-        }
-        async createSecret(projectId, secret) {
-          await this.createProjectSecret({
-            projectId,
-            name: secret.name,
-            type: secret.type,
-            data: utils_js_1.encoder.encode(JSON.stringify(this.toSecretPayload(secret).data))
-          });
-        }
-        async updateSecret(projectId, secret) {
-          if (!secret.id) {
-            throw new requirement_js_1.RoomException("Secret id is required to update a secret");
-          }
-          await this.updateProjectSecret({
-            projectId,
-            secretId: secret.id,
-            name: secret.name,
-            type: secret.type,
-            data: utils_js_1.encoder.encode(JSON.stringify(this.toSecretPayload(secret).data))
-          });
-        }
-        async deleteSecret(projectId, secretId) {
-          await this.deleteProjectSecret(projectId, secretId);
-        }
-        async listSecrets(projectId) {
-          const secretInfos = await this.listProjectSecrets(projectId);
-          const secrets = await Promise.all(secretInfos.map(async (secretInfo) => {
-            const secret = await this.getProjectSecret(projectId, secretInfo.id);
-            return this.parseSecretPayload(secret, secret.data);
-          }));
-          return secrets;
-        }
-        async createProjectExternalOAuthRegistration(params) {
-          const { projectId, oauth, clientId, clientSecret, delegatedTo, connector } = params;
-          const payload = await this.request(`/accounts/projects/${projectId}/external-oauth`, {
-            method: "POST",
-            json: {
-              oauth,
-              client_id: clientId,
-              client_secret: clientSecret,
-              delegated_to: delegatedTo,
-              connector: this.serializeConnectorRef(connector)
-            },
-            action: "create project external oauth registration"
-          });
-          if (!payload || typeof payload !== "object" || typeof payload.id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid create project external oauth registration response payload");
-          }
-          return payload.id;
-        }
-        async updateProjectExternalOAuthRegistration(params) {
-          const { projectId, registrationId, oauth, clientId, clientSecret, delegatedTo, connector } = params;
-          await this.request(`/accounts/projects/${projectId}/external-oauth/${registrationId}`, {
-            method: "PUT",
-            json: {
-              oauth,
-              client_id: clientId,
-              client_secret: clientSecret,
-              delegated_to: delegatedTo,
-              connector: this.serializeConnectorRef(connector)
-            },
-            action: "update project external oauth registration",
-            responseType: "void"
-          });
-        }
-        async listProjectExternalOAuthRegistrations(params) {
-          const { projectId, delegatedTo } = params;
-          const data = await this.request(`/accounts/projects/${projectId}/external-oauth`, {
-            query: {
-              delegated_to: delegatedTo
-            },
-            action: "list project external oauth registrations"
-          });
-          const registrations = Array.isArray(data?.registrations) ? data.registrations : [];
-          return registrations.map((item) => this.parseExternalOAuthClientRegistration(item));
-        }
-        async deleteProjectExternalOAuthRegistration(params) {
-          const { projectId, registrationId, delegatedTo } = params;
-          await this.request(`/accounts/projects/${projectId}/external-oauth/${registrationId}`, {
-            method: "DELETE",
-            query: {
-              delegated_to: delegatedTo
-            },
-            action: "delete project external oauth registration",
-            responseType: "void"
-          });
-        }
-        async createRoomExternalOAuthRegistration(params) {
-          const { projectId, roomName, oauth, clientId, clientSecret, delegatedTo, connector } = params;
-          const payload = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/external-oauth`, {
-            method: "POST",
-            json: {
-              oauth,
-              client_id: clientId,
-              client_secret: clientSecret,
-              delegated_to: delegatedTo,
-              connector: this.serializeConnectorRef(connector)
-            },
-            action: "create room external oauth registration"
-          });
-          if (!payload || typeof payload !== "object" || typeof payload.id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid create room external oauth registration response payload");
-          }
-          return payload.id;
-        }
-        async updateRoomExternalOAuthRegistration(params) {
-          const { projectId, roomName, registrationId, oauth, clientId, clientSecret, delegatedTo, connector } = params;
-          await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/external-oauth/${registrationId}`, {
-            method: "PUT",
-            json: {
-              oauth,
-              client_id: clientId,
-              client_secret: clientSecret,
-              delegated_to: delegatedTo,
-              connector: this.serializeConnectorRef(connector)
-            },
-            action: "update room external oauth registration",
-            responseType: "void"
-          });
-        }
-        async listRoomExternalOAuthRegistrations(params) {
-          const { projectId, roomName, delegatedTo } = params;
-          const data = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/external-oauth`, {
-            query: {
-              delegated_to: delegatedTo
-            },
-            action: "list room external oauth registrations"
-          });
-          const registrations = Array.isArray(data?.registrations) ? data.registrations : [];
-          return registrations.map((item) => this.parseExternalOAuthClientRegistration(item));
-        }
-        async deleteRoomExternalOAuthRegistration(params) {
-          const { projectId, roomName, registrationId, delegatedTo } = params;
-          await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/external-oauth/${registrationId}`, {
-            method: "DELETE",
-            query: {
-              delegated_to: delegatedTo
-            },
-            action: "delete room external oauth registration",
-            responseType: "void"
-          });
-        }
         async createRoom(params) {
-          const { projectId, name, ifNotExists = false, metadata, annotations, permissions } = params;
+          const { projectId, name, ifNotExists = false, metadata, annotations } = params;
           const payload = {
             name,
             if_not_exists: Boolean(ifNotExists),
             metadata,
             annotations
           };
-          if (permissions) {
-            const serialized = {};
-            for (const [key, value] of Object.entries(permissions)) {
-              serialized[key] = value instanceof participant_token_js_1.ApiScope ? value.toJSON() : value;
-            }
-            payload["permissions"] = serialized;
-          }
           const data = await this.request(`/accounts/projects/${projectId}/rooms`, {
             method: "POST",
             json: payload,
@@ -43506,76 +43355,103 @@ ${newlined}
             responseType: "void"
           });
         }
-        async connectRoom(projectId, room) {
-          const data = await this.request(`/accounts/projects/${projectId}/rooms/${room}/connect`, {
+        async createGroup(params) {
+          const { projectId, name, metadata, annotations } = params;
+          const data = await this.request(`/accounts/projects/${projectId}/groups`, {
             method: "POST",
-            json: {},
-            action: "connect room"
+            json: { name, metadata, annotations },
+            action: "create group"
           });
-          return this.parseRoomConnectionInfo(data);
+          return this.parseGroup(data);
         }
-        async createRoomGrant(params) {
-          const { projectId, roomId, userId, permissions } = params;
-          await this.request(`/accounts/projects/${projectId}/room-grants`, {
-            method: "POST",
-            json: {
-              room_id: roomId,
-              user_id: userId,
-              permissions: permissions.toJSON()
-            },
-            action: "create room grant",
+        async getGroup(projectId, groupId) {
+          const data = await this.request(`/accounts/projects/${projectId}/groups/${groupId}`, {
+            action: "fetch group"
+          });
+          return this.parseGroup(data);
+        }
+        async updateGroup(projectId, groupId, name, options = {}) {
+          const payload = { name };
+          if (options.metadata !== void 0) {
+            payload["metadata"] = options.metadata;
+          }
+          if (options.annotations !== void 0) {
+            payload["annotations"] = options.annotations;
+          }
+          await this.request(`/accounts/projects/${projectId}/groups/${groupId}`, {
+            method: "PUT",
+            json: payload,
+            action: "update group",
             responseType: "void"
           });
         }
-        async createRoomGrantByEmail(params) {
-          const { projectId, roomId, email, permissions, inviteRedirectUrl } = params;
-          await this.request(`/accounts/projects/${projectId}/room-grants`, {
-            method: "POST",
-            json: {
-              room_id: roomId,
-              email,
-              permissions: permissions.toJSON(),
-              ...inviteRedirectUrl !== void 0 ? { invite_redirect_url: inviteRedirectUrl } : {}
-            },
-            action: "create room grant",
+        async deleteGroup(projectId, groupId) {
+          await this.request(`/accounts/projects/${projectId}/groups/${groupId}`, {
+            method: "DELETE",
+            action: "delete group",
             responseType: "void"
           });
         }
-        async updateRoomGrant(params) {
-          const { projectId, roomId, userId, permissions, grantId } = params;
-          const gid = grantId ?? "unused";
-          await this.request(`/accounts/projects/${projectId}/room-grants/${gid}`, {
-            method: "PUT",
-            json: {
-              room_id: roomId,
-              user_id: userId,
-              permissions: permissions.toJSON()
+        async listGroupsPage(projectId, options = {}) {
+          const data = await this.request(`/accounts/projects/${projectId}/groups`, {
+            query: {
+              page_size: options.pageSize ?? 50,
+              continuation_token: options.continuationToken,
+              filter: options.filter
             },
-            action: "update room grant",
+            action: "list groups"
+          });
+          const groups = Array.isArray(data?.groups) ? data.groups : [];
+          return {
+            groups: groups.map((item) => this.parseGroup(item)),
+            continuationToken: data?.continuation_token ?? null
+          };
+        }
+        async listGroups(projectId, options = {}) {
+          const page = await this.listGroupsPage(projectId, options);
+          return page.groups;
+        }
+        async setGroupMember(params) {
+          const { projectId, groupId, subject, role = "member" } = params;
+          await this.request(`/accounts/projects/${projectId}/groups/${groupId}/members`, {
+            method: "POST",
+            json: { subject, role },
+            action: "set group member",
             responseType: "void"
           });
         }
-        async deleteRoomGrant(projectId, roomId, userId) {
-          const room = this.encodePathComponent(roomId);
-          const user = this.encodePathComponent(userId);
-          await this.request(`/accounts/projects/${projectId}/room-grants/${room}/${user}`, {
+        async listGroupMembersPage(projectId, groupId, options = {}) {
+          const data = await this.request(`/accounts/projects/${projectId}/groups/${groupId}/members`, {
+            query: { page_size: options.pageSize ?? 50, continuation_token: options.continuationToken },
+            action: "list group members"
+          });
+          const members = Array.isArray(data?.members) ? data.members : [];
+          return { members: members.map((item) => this.parseGroupMember(item)), continuationToken: data?.continuation_token ?? null };
+        }
+        async listGroupMembers(projectId, groupId, options = {}) {
+          const page = await this.listGroupMembersPage(projectId, groupId, options);
+          return page.members;
+        }
+        async deleteGroupMember(params) {
+          const { projectId, groupId, subjectType, subjectId } = params;
+          await this.request(`/accounts/projects/${projectId}/groups/${groupId}/members/${subjectType}/${subjectId}`, {
             method: "DELETE",
-            action: "delete room grant",
+            action: "delete group member",
             responseType: "void"
           });
         }
-        async getRoomGrant(projectId, roomId, userId) {
-          const room = this.encodePathComponent(roomId);
-          const user = this.encodePathComponent(userId);
-          const data = await this.request(`/accounts/projects/${projectId}/room-grants/${room}/${user}`, {
-            action: "fetch room grant"
+        async connectRoom(projectId, room) {
+          const data = await this.request(`/accounts/projects/${projectId}/rooms/${room}/connect`, {
+            method: "POST",
+            json: {},
+            action: "connect room"
           });
-          return this.parseProjectRoomGrant(data);
+          return this.parseRoomConnectionInfo(data);
         }
         async listRooms(projectId, options = {}) {
-          const { limit = 50, offset = 0, orderBy = "room_name" } = options;
+          const { pageSize = 50, continuationToken, filter, view } = options;
           const data = await this.request(`/accounts/projects/${projectId}/rooms`, {
-            query: { limit, offset, order_by: orderBy },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter, view },
             action: "list rooms"
           });
           const rooms = Array.isArray(data?.rooms) ? data.rooms : [];
@@ -43606,16 +43482,23 @@ ${newlined}
           return this.parseRoute(data.route);
         }
         async listRoutesPage(projectId, options = {}) {
-          const { count = 100, offset = 0, filter } = options;
+          const { pageSize = 100, continuationToken, filter } = options;
           const data = await this.request(`/accounts/projects/${projectId}/routes`, {
-            query: { count, offset, filter },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter },
             action: "list routes"
           });
           const routes = Array.isArray(data.routes) ? data.routes.map((item) => this.parseRoute(item)) : [];
-          return { routes, total: Number(data.total ?? routes.length) };
+          return { routes, total: Number(data.total ?? routes.length), continuationToken: data.continuation_token ?? null };
         }
         async listRoutes(projectId, options = {}) {
-          return (await this.listRoutesPage(projectId, options)).routes;
+          const routes = [];
+          let continuationToken;
+          do {
+            const page = await this.listRoutesPage(projectId, { ...options, continuationToken });
+            routes.push(...page.routes);
+            continuationToken = page.continuationToken ?? void 0;
+          } while (continuationToken);
+          return routes;
         }
         async listRoomRoutesPage(params) {
           const { projectId, roomName, count = 100, offset = 0, filter } = params;
@@ -43651,63 +43534,111 @@ ${newlined}
             responseType: "void"
           });
         }
-        async listRoomGrants(projectId, options = {}) {
-          const { limit = 50, offset = 0, orderBy = "room_name" } = options;
-          const data = await this.request(`/accounts/projects/${projectId}/room-grants`, {
-            query: { limit, offset, order_by: orderBy },
-            action: "list room grants"
+        async testAccess(projectId, params) {
+          const data = await this.request(`/accounts/projects/${projectId}/access:test`, {
+            method: "POST",
+            json: {
+              subject: this.serializeAccessSubject(params.subject),
+              resource: this.serializeAccessResource(params.resource),
+              relation: params.relation
+            },
+            action: "test access"
           });
-          const grants = Array.isArray(data?.room_grants) ? data.room_grants : [];
-          return grants.map((item) => this.parseProjectRoomGrant(item));
+          return {
+            allowed: data?.allowed === true,
+            resource: data?.resource && typeof data.resource === "object" ? this.parseAccessResource(data.resource) : void 0,
+            subject: data?.subject && typeof data.subject === "object" ? this.parseAccessSubject(data.subject) : void 0,
+            relation: typeof data?.relation === "string" ? data.relation : void 0
+          };
         }
-        async listRoomGrantsByUser(projectId, userId, options = {}) {
-          const { limit = 50, offset = 0 } = options;
-          const encodedUser = this.encodePathComponent(userId);
-          const data = await this.request(`/accounts/projects/${projectId}/room-grants/by-user/${encodedUser}`, {
-            query: { limit, offset },
-            action: "list room grants by user"
+        async getEffectiveAccess(projectId, params) {
+          const data = await this.request(`/accounts/projects/${projectId}/access:effective`, {
+            method: "POST",
+            json: {
+              subject: this.serializeAccessSubject(params.subject),
+              resource: this.serializeAccessResource(params.resource),
+              ...params.relations ? { relations: params.relations } : {}
+            },
+            action: "get effective access"
           });
-          const grants = Array.isArray(data?.room_grants) ? data.room_grants : [];
-          return grants.map((item) => this.parseProjectRoomGrant(item));
+          return {
+            resource: this.parseAccessResource(data?.resource),
+            subject: this.parseAccessSubject(data?.subject),
+            effectiveRoles: Array.isArray(data?.effective_roles) ? data.effective_roles.filter((item) => typeof item === "string") : [],
+            capabilities: data?.capabilities && typeof data.capabilities === "object" ? data.capabilities : {}
+          };
+        }
+        async listAccessBindings(projectId, params) {
+          const page = await this.listAccessBindingsPage(projectId, params);
+          return page.accessGrants;
         }
-        async listRoomGrantsByRoom(projectId, roomId, options = {}) {
-          const { limit = 50, offset = 0 } = options;
-          const encodedRoom = this.encodePathComponent(roomId);
-          const data = await this.request(`/accounts/projects/${projectId}/room-grants/by-room/${encodedRoom}`, {
-            query: { limit, offset },
-            action: "list room grants by room"
+        async listAccessBindingsPage(projectId, params) {
+          const data = await this.request(`/accounts/projects/${projectId}/access:bindings`, {
+            method: "POST",
+            json: {
+              subject: this.serializeAccessSubject(params.subject)
+            },
+            action: "list access bindings"
           });
-          const grants = Array.isArray(data?.room_grants) ? data.room_grants : [];
-          return grants.map((item) => this.parseProjectRoomGrant(item));
+          return {
+            accessGrants: Array.isArray(data?.access_grants) ? data.access_grants.map((item) => this.parseProjectRoomGrant(item)) : []
+          };
         }
-        async listUniqueRoomsWithGrants(projectId, options = {}) {
-          const { limit = 50, offset = 0 } = options;
-          const data = await this.request(`/accounts/projects/${projectId}/room-grants/by-room`, {
-            query: { limit, offset },
-            action: "list unique rooms with grants"
+        async getResourcePolicyPage(projectId, params) {
+          this.validateResourcePolicyType(params.resourceType);
+          const data = await this.request(`/accounts/projects/${projectId}/iam/${params.resourceType}/${params.resourceId}/policy`, {
+            method: "GET",
+            query: { page_size: params.pageSize ?? 50, continuation_token: params.continuationToken },
+            action: "get resource policy"
           });
-          const rooms = Array.isArray(data?.rooms) ? data.rooms : [];
-          return rooms.map((item) => this.parseProjectRoomGrantCount(item));
+          return {
+            resource: this.parseAccessResource(data?.resource),
+            accessGrants: Array.isArray(data?.access_grants) ? data.access_grants.map((item) => this.parseProjectRoomGrant(item)) : [],
+            continuationToken: typeof data?.continuation_token === "string" ? data.continuation_token : null
+          };
         }
-        async listUniqueUsersWithGrantsPage(projectId, options = {}) {
-          const { limit = 100, offset = 0, filter } = options;
-          const data = await this.request(`/accounts/projects/${projectId}/room-grants/by-user`, {
-            query: { limit, offset, filter },
-            action: "list unique users with grants"
+        async getResourcePolicy(projectId, params) {
+          const grants = [];
+          let continuationToken = params.continuationToken;
+          do {
+            const page = await this.getResourcePolicyPage(projectId, { ...params, continuationToken });
+            grants.push(...page.accessGrants);
+            continuationToken = page.continuationToken ?? void 0;
+          } while (continuationToken);
+          return grants;
+        }
+        async grantResourcePolicy(projectId, params) {
+          this.validateResourcePolicyType(params.resourceType);
+          await this.request(`/accounts/projects/${projectId}/iam/${params.resourceType}/${params.resourceId}/policy:grant`, {
+            method: "POST",
+            json: {
+              subject: this.serializeAccessSubject(params.subject),
+              roles: params.roles,
+              ...params.inviteRedirectUrl ? { invite_redirect_url: params.inviteRedirectUrl } : {}
+            },
+            action: "grant resource policy"
           });
-          const users = Array.isArray(data?.users) ? data.users : [];
-          const parsed = users.map((item) => this.parseProjectUserGrantCount(item));
-          return { users: parsed, total: typeof data?.total === "number" ? data.total : parsed.length };
         }
-        async listUniqueUsersWithGrants(projectId, options = {}) {
-          const page = await this.listUniqueUsersWithGrantsPage(projectId, options);
-          return page.users;
+        async revokeResourcePolicy(projectId, params) {
+          this.validateResourcePolicyType(params.resourceType);
+          await this.request(`/accounts/projects/${projectId}/iam/${params.resourceType}/${params.resourceId}/policy:revoke`, {
+            method: "POST",
+            json: {
+              subject: this.serializeAccessSubject(params.subject)
+            },
+            action: "revoke resource policy"
+          });
+        }
+        validateResourcePolicyType(resourceType) {
+          if (resourceType === "agent") {
+            throw new Error("managed agent resource policies are not supported; use agent run_as instead");
+          }
         }
         async createOAuthClient(projectId, params) {
-          const { grantTypes, responseTypes, redirectUris, scope, metadata = {} } = params;
+          const { grantTypes, responseTypes, redirectUris, scope, metadata = {}, official = false } = params;
           const data = await this.request(`/accounts/projects/${projectId}/oauth/clients`, {
             method: "POST",
-            json: { grant_types: grantTypes, response_types: responseTypes, redirect_uris: redirectUris, scope, metadata },
+            json: { grant_types: grantTypes, response_types: responseTypes, redirect_uris: redirectUris, scope, metadata, official },
             action: "create oauth client"
           });
           return this.parseOAuthClient(data);
@@ -44730,23 +44661,73 @@ ${newlined}
       Object.defineProperty(exports, "__esModule", { value: true });
       exports.fullOAuthScope = exports.fullOAuthScopes = void 0;
       exports.fullOAuthScopes = [
-        "profile",
+        "profile:read",
+        "profile:write",
         "project/*",
         "room/*",
-        "create_users",
-        "create_rooms",
-        "create_agents",
-        "managed_agents",
-        "llm_proxy",
-        "admin",
-        "developer",
-        "connect_room",
-        "delete_room",
-        "update_room",
-        "delete_agent",
-        "update_agent"
+        "users:create",
+        "users:read",
+        "users:update",
+        "users:delete",
+        "projects:read",
+        "projects:update",
+        "projects:iam.read",
+        "projects:iam.write",
+        "projects:billing.read",
+        "projects:billing.write",
+        "rooms:create",
+        "rooms:read",
+        "rooms:connect",
+        "rooms:update",
+        "rooms:delete",
+        "agents:create",
+        "agents:read",
+        "agents:update",
+        "agents:delete",
+        "agents:run",
+        "agents:sessions.read",
+        "mailboxes:create",
+        "mailboxes:read",
+        "mailboxes:update",
+        "mailboxes:delete",
+        "routes:create",
+        "routes:read",
+        "routes:update",
+        "routes:delete",
+        "scheduledTasks:create",
+        "scheduledTasks:read",
+        "scheduledTasks:update",
+        "scheduledTasks:delete",
+        "services:create",
+        "services:read",
+        "services:update",
+        "services:delete",
+        "repositories:create",
+        "repositories:read",
+        "repositories:update",
+        "repositories:delete",
+        "apiKeys:create",
+        "apiKeys:read",
+        "apiKeys:delete",
+        "serviceAccounts:create",
+        "serviceAccounts:read",
+        "serviceAccounts:update",
+        "serviceAccounts:delete",
+        "oauthClients:create",
+        "oauthClients:read",
+        "oauthClients:update",
+        "oauthClients:delete",
+        "llm:invoke",
+        "llm:usage.read",
+        "llm:logs.read",
+        "llm:logs.write",
+        "secrets:read",
+        "secrets:write",
+        "secrets:delete",
+        "secrets:grant",
+        "secrets:proxy"
       ];
-      exports.fullOAuthScope = "profile project/* room/* create_users create_rooms create_agents managed_agents llm_proxy admin developer connect_room delete_room update_room delete_agent update_agent";
+      exports.fullOAuthScope = exports.fullOAuthScopes.join(" ");
     }
   });
 
@@ -44784,355 +44765,677 @@ ${newlined}
           if (!(response instanceof response_js_1.JsonContent)) {
             throw this._unexpectedResponseError("list");
           }
-          const queues = response.json["queues"];
-          return queues.map((q) => new Queue({ name: q["name"], size: q["size"] }));
+          const queues = response.json["queues"];
+          return queues.map((q) => new Queue({ name: q["name"], size: q["size"] }));
+        }
+        async open(name) {
+          const response = await this._invoke("open", { name });
+          if (!(response instanceof response_js_1.EmptyContent)) {
+            throw this._unexpectedResponseError("open");
+          }
+        }
+        async drain(name) {
+          const response = await this._invoke("drain", { name });
+          if (!(response instanceof response_js_1.EmptyContent)) {
+            throw this._unexpectedResponseError("drain");
+          }
+        }
+        async close(name) {
+          const response = await this._invoke("close", { name });
+          if (!(response instanceof response_js_1.EmptyContent)) {
+            throw this._unexpectedResponseError("close");
+          }
+        }
+        async send(name, message2, { create = true }) {
+          const response = await this._invoke("send", { name, create, message: message2 });
+          if (!(response instanceof response_js_1.EmptyContent)) {
+            throw this._unexpectedResponseError("send");
+          }
+        }
+        async receive(name, { create = true, wait = true }) {
+          const response = await this._invoke("receive", {
+            name,
+            create,
+            wait
+          });
+          if (response instanceof response_js_1.EmptyContent) {
+            return null;
+          }
+          if (response instanceof response_js_1.JsonContent) {
+            return response.json;
+          }
+          throw this._unexpectedResponseError("receive");
+        }
+      };
+      exports.QueuesClient = QueuesClient;
+    }
+  });
+
+  // ../meshagent-ts/dist/browser/sqlite-client.js
+  var require_sqlite_client = __commonJS({
+    "../meshagent-ts/dist/browser/sqlite-client.js"(exports) {
+      "use strict";
+      Object.defineProperty(exports, "__esModule", { value: true });
+      exports.SqliteClient = exports.SqliteDatabaseClient = void 0;
+      var apache_arrow_1 = require_Arrow_dom();
+      var room_server_client_js_1 = require_room_server_client();
+      var response_js_1 = require_response();
+      var datasets_client_js_1 = require_datasets_client();
+      var ARROW_IPC_STREAM_MIME_TYPE = "application/vnd.apache.arrow.stream";
+      var globalScope = globalThis;
+      async function* toAsyncArrowIterable(chunks) {
+        if (Symbol.asyncIterator in chunks) {
+          for await (const chunk of chunks) {
+            yield chunk;
+          }
+          return;
+        }
+        for (const chunk of chunks) {
+          yield chunk;
+        }
+      }
+      function isRecord(value) {
+        return typeof value === "object" && value !== null && !Array.isArray(value);
+      }
+      function bytesToBase64(bytes) {
+        if (globalScope.Buffer) {
+          return globalScope.Buffer.from(bytes).toString("base64");
+        }
+        if (!globalScope.btoa) {
+          throw new Error("base64 encoding is not available in this runtime");
+        }
+        let binary = "";
+        for (const byte of bytes) {
+          binary += String.fromCharCode(byte);
+        }
+        return globalScope.btoa(binary);
+      }
+      function encodeRecordValue(value) {
+        if (value instanceof datasets_client_js_1.DatasetValueEncoder) {
+          return value.encodeDatasetValue();
+        }
+        if (value instanceof Uint8Array) {
+          return {
+            binary: bytesToBase64(value)
+          };
+        }
+        if (value instanceof Date) {
+          return {
+            timestamp: value.toISOString().replace("+00:00", "Z")
+          };
+        }
+        if (Array.isArray(value)) {
+          return {
+            list: value.map((item) => encodeRecordValue(item))
+          };
+        }
+        if (isRecord(value)) {
+          throw new room_server_client_js_1.RoomServerException("sqlite object values must use DatasetStruct or DatasetJson");
+        }
+        return value;
+      }
+      function buildWhereClause(where) {
+        if (where != null && typeof where === "object" && !Array.isArray(where)) {
+          return Object.fromEntries(Object.entries(where).map(([key, value]) => [key, encodeRecordValue(value)]));
+        }
+        if (typeof where === "string") {
+          return where;
+        }
+        return null;
+      }
+      function schemaToIPC(schema) {
+        return (0, apache_arrow_1.tableToIPC)(new apache_arrow_1.Table(schema, []), "stream");
+      }
+      function tableFromIPCBytes(data) {
+        const table = (0, apache_arrow_1.tableFromIPC)(data);
+        if (table instanceof Promise) {
+          throw new room_server_client_js_1.RoomServerException("unexpected async Arrow IPC result");
+        }
+        return table;
+      }
+      function tableFromChunks(chunks) {
+        if (chunks.length === 0) {
+          return new apache_arrow_1.Table(new apache_arrow_1.Schema([]), []);
+        }
+        const [first, ...rest] = chunks;
+        return first.concat(...rest);
+      }
+      function schemaFromIPCBytes(data) {
+        return tableFromIPCBytes(data).schema;
+      }
+      var SqliteArrowWriteInputStream = class {
+        constructor(start, chunks, schema) {
+          this.start = start;
+          this.schema = schema;
+          this.pulls = [];
+          this.closed = false;
+          this.source = toAsyncArrowIterable(chunks)[Symbol.asyncIterator]();
+        }
+        requestNext() {
+          if (this.closed) {
+            return;
+          }
+          const waiter = this.pulls.shift();
+          if (waiter) {
+            waiter();
+            return;
+          }
+          this.pulls.push(() => void 0);
+        }
+        close() {
+          if (this.closed) {
+            return;
+          }
+          this.closed = true;
+          while (this.pulls.length > 0) {
+            const waiter = this.pulls.shift();
+            waiter?.();
+          }
+          void this.source.return?.();
+        }
+        async waitForPull() {
+          if (this.closed) {
+            return;
+          }
+          const waiter = this.pulls.shift();
+          if (waiter) {
+            waiter();
+            return;
+          }
+          await new Promise((resolve) => {
+            this.pulls.push(resolve);
+          });
+        }
+        async *stream() {
+          yield new response_js_1.BinaryContent({
+            data: this.schema == null ? new Uint8Array() : schemaToIPC(this.schema),
+            headers: this.start
+          });
+          while (!this.closed) {
+            await this.waitForPull();
+            if (this.closed) {
+              return;
+            }
+            const nextChunk = await this.source.next();
+            if (nextChunk.done) {
+              return;
+            }
+            if (nextChunk.value.numRows === 0) {
+              continue;
+            }
+            yield new response_js_1.BinaryContent({
+              data: (0, apache_arrow_1.tableToIPC)(nextChunk.value, "stream"),
+              headers: { kind: "data", content_type: ARROW_IPC_STREAM_MIME_TYPE }
+            });
+          }
+        }
+      };
+      var SqliteArrowReadInputStream = class {
+        constructor(start) {
+          this.start = start;
+          this.pulls = [];
+          this.closed = false;
+        }
+        requestNext() {
+          if (this.closed) {
+            return;
+          }
+          const waiter = this.pulls.shift();
+          if (waiter) {
+            waiter();
+            return;
+          }
+          this.pulls.push(() => void 0);
+        }
+        close() {
+          if (this.closed) {
+            return;
+          }
+          this.closed = true;
+          while (this.pulls.length > 0) {
+            const waiter = this.pulls.shift();
+            waiter?.();
+          }
+        }
+        async waitForPull() {
+          if (this.closed) {
+            return;
+          }
+          const waiter = this.pulls.shift();
+          if (waiter) {
+            waiter();
+            return;
+          }
+          await new Promise((resolve) => {
+            this.pulls.push(resolve);
+          });
+        }
+        async *stream() {
+          yield new response_js_1.BinaryContent({ data: new Uint8Array(), headers: this.start });
+          while (!this.closed) {
+            await this.waitForPull();
+            if (this.closed) {
+              return;
+            }
+            yield new response_js_1.BinaryContent({ data: new Uint8Array(), headers: { kind: "pull" } });
+          }
+        }
+      };
+      var SqliteDatabaseClient = class {
+        constructor(client, database, namespace) {
+          this.client = client;
+          this.database = database;
+          this.namespace = namespace;
+        }
+        async createDatabase({ mode = "create" } = {}) {
+          return this.client.createDatabase({ name: this.database, namespace: this.namespace, mode });
+        }
+        async dropDatabase({ ignoreMissing = false } = {}) {
+          return this.client.dropDatabase({ name: this.database, namespace: this.namespace, ignoreMissing });
+        }
+        async inspectDatabase() {
+          return this.client.inspectDatabase({ name: this.database, namespace: this.namespace });
+        }
+        async listTables() {
+          return this.client.listTables({ database: this.database, namespace: this.namespace });
+        }
+        async createTableWithSchema(params) {
+          return this.client.createTableWithSchema({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async createTableFromData(params) {
+          return this.client.createTableFromData({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async dropTable(params) {
+          return this.client.dropTable({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async renameTable(params) {
+          return this.client.renameTable({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async inspect(params) {
+          return this.client.inspect({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async addColumns(params) {
+          return this.client.addColumns({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async dropColumns(params) {
+          return this.client.dropColumns({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async insert(params) {
+          return this.client.insert({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async update(params) {
+          return this.client.update({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async delete(params) {
+          return this.client.delete({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async search(params) {
+          return this.client.search({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async searchTable(params) {
+          return this.client.searchTable({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async searchStream(params) {
+          return this.client.searchStream({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async count(params) {
+          return this.client.count({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async sql(params) {
+          return this.client.sql({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async sqlTable(params) {
+          return this.client.sqlTable({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async *sqlStream(params) {
+          yield* this.client.sqlStream({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async executeSql(params) {
+          return this.client.executeSql({ ...params, database: this.database, namespace: this.namespace });
+        }
+        async executeSqlStatement(params) {
+          return this.client.executeSqlStatement({ ...params, database: this.database, namespace: this.namespace });
+        }
+      };
+      exports.SqliteDatabaseClient = SqliteDatabaseClient;
+      var SqliteClient = class {
+        constructor({ room }) {
+          this.room = room;
+        }
+        unexpectedResponseError(operation) {
+          return new room_server_client_js_1.RoomServerException(`unexpected return type from sqlite.${operation}`);
+        }
+        database(name, { namespace } = {}) {
+          return new SqliteDatabaseClient(this, name, namespace);
+        }
+        async invoke(operation, input) {
+          return await this.room.invokeContent({ toolkit: "sqlite", tool: operation, input });
+        }
+        async invokeContent(operation, input) {
+          return await this.room.invokeContent({ toolkit: "sqlite", tool: operation, input });
+        }
+        async invokeStream(operation, input) {
+          return await this.room.invokeStream({ toolkit: "sqlite", tool: operation, input });
+        }
+        async drainWriteStream(operation, input) {
+          const response = await this.invokeStream(operation, input.stream());
+          try {
+            for await (const chunk of response) {
+              if (chunk instanceof response_js_1.ErrorContent) {
+                throw new room_server_client_js_1.RoomServerException(chunk.text, chunk.code);
+              }
+              if (chunk instanceof response_js_1.ControlContent) {
+                if (chunk.method === "close") {
+                  return;
+                }
+                throw this.unexpectedResponseError(operation);
+              }
+              if (!(chunk instanceof response_js_1.BinaryContent) || chunk.headers.kind !== "pull") {
+                throw this.unexpectedResponseError(operation);
+              }
+              input.requestNext();
+            }
+          } finally {
+            input.close();
+          }
+        }
+        async *streamArrow(operation, start) {
+          const input = new SqliteArrowReadInputStream(start);
+          const response = await this.invokeStream(operation, input.stream());
+          input.requestNext();
+          try {
+            for await (const chunk of response) {
+              if (chunk instanceof response_js_1.ErrorContent) {
+                throw new room_server_client_js_1.RoomServerException(chunk.text, chunk.code);
+              }
+              if (chunk instanceof response_js_1.ControlContent) {
+                if (chunk.method === "close") {
+                  return;
+                }
+                throw this.unexpectedResponseError(operation);
+              }
+              if (!(chunk instanceof response_js_1.BinaryContent) || chunk.headers.kind !== "data") {
+                throw this.unexpectedResponseError(operation);
+              }
+              yield tableFromIPCBytes(chunk.data);
+              input.requestNext();
+            }
+          } finally {
+            input.close();
+          }
         }
-        async open(name) {
-          const response = await this._invoke("open", { name });
-          if (!(response instanceof response_js_1.EmptyContent)) {
-            throw this._unexpectedResponseError("open");
+        async listDatabases({ namespace } = {}) {
+          const response = await this.invoke("list_databases", { namespace: namespace ?? null });
+          if (!(response instanceof response_js_1.JsonContent) || !Array.isArray(response.json.databases)) {
+            throw this.unexpectedResponseError("list_databases");
           }
+          return response.json.databases;
         }
-        async drain(name) {
-          const response = await this._invoke("drain", { name });
+        async createDatabase({ name, namespace, mode = "create" }) {
+          const response = await this.invoke("create_database", { name, namespace: namespace ?? null, mode });
           if (!(response instanceof response_js_1.EmptyContent)) {
-            throw this._unexpectedResponseError("drain");
+            throw this.unexpectedResponseError("create_database");
           }
         }
-        async close(name) {
-          const response = await this._invoke("close", { name });
+        async dropDatabase({ name, namespace, ignoreMissing = false }) {
+          const response = await this.invoke("drop_database", { name, namespace: namespace ?? null, ignore_missing: ignoreMissing });
           if (!(response instanceof response_js_1.EmptyContent)) {
-            throw this._unexpectedResponseError("close");
+            throw this.unexpectedResponseError("drop_database");
           }
         }
-        async send(name, message2, { create = true }) {
-          const response = await this._invoke("send", { name, create, message: message2 });
-          if (!(response instanceof response_js_1.EmptyContent)) {
-            throw this._unexpectedResponseError("send");
+        async inspectDatabase({ name, namespace }) {
+          const response = await this.invoke("inspect_database", { name, namespace: namespace ?? null });
+          if (!(response instanceof response_js_1.JsonContent) || typeof response.json.name !== "string" || typeof response.json.tables !== "number") {
+            throw this.unexpectedResponseError("inspect_database");
           }
+          return {
+            name: response.json.name,
+            namespace: Array.isArray(response.json.namespace) ? response.json.namespace : null,
+            tables: response.json.tables,
+            sizeBytes: typeof response.json.size_bytes === "number" ? response.json.size_bytes : 0
+          };
         }
-        async receive(name, { create = true, wait = true }) {
-          const response = await this._invoke("receive", {
-            name,
-            create,
-            wait
-          });
-          if (response instanceof response_js_1.EmptyContent) {
-            return null;
-          }
-          if (response instanceof response_js_1.JsonContent) {
-            return response.json;
+        async listTables({ database, namespace }) {
+          const response = await this.invoke("list_tables", { database, namespace: namespace ?? null });
+          if (!(response instanceof response_js_1.JsonContent) || !Array.isArray(response.json.tables)) {
+            throw this.unexpectedResponseError("list_tables");
           }
-          throw this._unexpectedResponseError("receive");
+          return response.json.tables;
         }
-      };
-      exports.QueuesClient = QueuesClient;
-    }
-  });
-
-  // ../meshagent-ts/dist/browser/secrets-client.js
-  var require_secrets_client = __commonJS({
-    "../meshagent-ts/dist/browser/secrets-client.js"(exports) {
-      "use strict";
-      Object.defineProperty(exports, "__esModule", { value: true });
-      exports.SecretsClient = void 0;
-      var response_js_1 = require_response();
-      var room_server_client_js_1 = require_room_server_client();
-      var utils_js_1 = require_utils();
-      function isRecord(value) {
-        return typeof value === "object" && value !== null && !Array.isArray(value);
-      }
-      var SecretsClient = class {
-        constructor({ room, oauthTokenRequestHandler, secretRequestHandler }) {
-          this._oauthRequestHandler = this._handleClientOAuthTokenRequest.bind(this);
-          this._secretRequestHandler = this._handleClientSecretRequest.bind(this);
-          this.client = room;
-          this.oauthTokenRequestHandler = oauthTokenRequestHandler;
-          this.secretRequestHandler = secretRequestHandler;
-          this.client.protocol.addHandler("secrets.request_oauth_token", this._oauthRequestHandler);
-          this.client.protocol.addHandler("secrets.request_secret", this._secretRequestHandler);
+        async createTable({ database, name, data, schema, mode = "create", namespace }) {
+          const input = new SqliteArrowWriteInputStream({
+            kind: "start",
+            database,
+            name,
+            mode,
+            namespace: namespace ?? null
+          }, data ?? [], schema);
+          await this.drainWriteStream("create_table", input);
         }
-        unexpectedResponse(operation) {
-          return new room_server_client_js_1.RoomServerException(`unexpected return type from secrets.${operation}`);
+        async createTableWithSchema({ database, name, schema, data, mode = "create", namespace }) {
+          return this.createTable({
+            database,
+            name,
+            schema,
+            data: data == null ? void 0 : data instanceof apache_arrow_1.Table ? [data] : data,
+            mode,
+            namespace
+          });
         }
-        async invoke(operation, input) {
-          return await this.client.invokeContent({
-            toolkit: "secrets",
-            tool: operation,
-            input
+        async createTableFromData({ database, name, data, mode = "create", namespace }) {
+          return this.createTable({
+            database,
+            name,
+            data: data == null ? void 0 : data instanceof apache_arrow_1.Table ? [data] : data,
+            mode,
+            namespace
           });
         }
-        serializeConnectorRef(connector) {
-          if (connector == null) {
-            return null;
+        async dropTable({ database, name, ignoreMissing = false, namespace }) {
+          const response = await this.invoke("drop_table", { database, name, ignore_missing: ignoreMissing, namespace: namespace ?? null });
+          if (!(response instanceof response_js_1.EmptyContent)) {
+            throw this.unexpectedResponseError("drop_table");
           }
-          return {
-            openai_connector_id: connector.openaiConnectorId ?? null,
-            server_url: connector.serverUrl ?? null,
-            client_secret_id: connector.clientSecretId ?? null
-          };
         }
-        serializeOAuthConfig(oauth) {
-          if (oauth == null) {
-            return null;
+        async renameTable({ database, name, newName, namespace }) {
+          const response = await this.invoke("rename_table", { database, name, new_name: newName, namespace: namespace ?? null });
+          if (!(response instanceof response_js_1.EmptyContent)) {
+            throw this.unexpectedResponseError("rename_table");
           }
-          return {
-            client_id: oauth.client_id,
-            client_secret: oauth.client_secret ?? null,
-            authorization_endpoint: oauth.authorization_endpoint,
-            token_endpoint: oauth.token_endpoint,
-            no_pkce: oauth.no_pkce ?? null,
-            scopes: oauth.scopes ?? null
-          };
         }
-        parseAccessToken(operation, response) {
-          if (!(response instanceof response_js_1.JsonContent)) {
-            throw this.unexpectedResponse(operation);
-          }
-          const token = response.json["access_token"];
-          if (typeof token !== "string" || token.length === 0) {
-            return null;
+        async inspect({ database, table, namespace }) {
+          const response = await this.invoke("inspect", { database, table, namespace: namespace ?? null });
+          if (!(response instanceof response_js_1.BinaryContent)) {
+            throw this.unexpectedResponseError("inspect");
           }
-          return token;
+          return schemaFromIPCBytes(response.data);
         }
-        parseSecretInfo(value) {
-          if (!isRecord(value) || typeof value["id"] !== "string" || typeof value["name"] !== "string" || typeof value["type"] !== "string") {
-            throw this.unexpectedResponse("list_secrets");
-          }
-          const delegatedTo = value["delegated_to"];
-          if (delegatedTo !== void 0 && delegatedTo !== null && typeof delegatedTo !== "string") {
-            throw this.unexpectedResponse("list_secrets");
+        async addColumns({ database, table, newColumns, namespace }) {
+          const response = await this.invokeContent("add_columns", new response_js_1.BinaryContent({
+            data: schemaToIPC(newColumns),
+            headers: {
+              database,
+              table,
+              namespace: namespace ?? null,
+              content_type: ARROW_IPC_STREAM_MIME_TYPE
+            }
+          }));
+          if (!(response instanceof response_js_1.EmptyContent)) {
+            throw this.unexpectedResponseError("add_columns");
           }
-          return {
-            id: value["id"],
-            name: value["name"],
-            type: value["type"],
-            delegatedTo
-          };
         }
-        async _handleClientOAuthTokenRequest(protocol, messageId, type, bytes) {
-          if (!this.client.isActiveProtocol(protocol)) {
-            return;
-          }
-          void messageId;
-          void type;
-          if (bytes == null) {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_oauth_token payload");
-          }
-          if (this.oauthTokenRequestHandler == null) {
-            throw new room_server_client_js_1.RoomServerException("No oauth token handler registered");
-          }
-          const [request] = (0, utils_js_1.unpackMessage)(bytes);
-          const requestId = request["request_id"];
-          const challenge = request["challenge"];
-          const requestPayload = request["request"];
-          if (typeof requestId !== "string" || !isRecord(requestPayload)) {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_oauth_token payload");
-          }
-          const oauth = requestPayload["oauth"];
-          if (!isRecord(oauth) || typeof oauth["authorization_endpoint"] !== "string" || typeof oauth["token_endpoint"] !== "string") {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_oauth_token payload");
-          }
-          const scopes = oauth["scopes"];
-          if (scopes !== void 0 && scopes !== null && (!Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string"))) {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_oauth_token payload");
+        async dropColumns({ database, table, columns, namespace }) {
+          const response = await this.invoke("drop_columns", { database, table, columns, namespace: namespace ?? null });
+          if (!(response instanceof response_js_1.EmptyContent)) {
+            throw this.unexpectedResponseError("drop_columns");
           }
-          Promise.resolve(this.oauthTokenRequestHandler({
-            requestId,
-            authorizationEndpoint: oauth["authorization_endpoint"],
-            tokenEndpoint: oauth["token_endpoint"],
-            challenge: typeof challenge === "string" ? challenge : null,
-            scopes: scopes ?? null,
-            clientId: typeof oauth["client_id"] === "string" ? oauth["client_id"] : null
-          })).catch((error) => {
-            console.warn("OAuth token request handler threw", error);
-          });
         }
-        async _handleClientSecretRequest(protocol, messageId, type, bytes) {
-          if (!this.client.isActiveProtocol(protocol)) {
-            return;
-          }
-          void messageId;
-          void type;
-          if (bytes == null) {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_secret payload");
-          }
-          if (this.secretRequestHandler == null) {
-            throw new room_server_client_js_1.RoomServerException("No secret handler registered");
-          }
-          const [request] = (0, utils_js_1.unpackMessage)(bytes);
-          const requestId = request["request_id"];
-          const requestPayload = request["request"];
-          if (typeof requestId !== "string" || !isRecord(requestPayload) || typeof requestPayload["url"] !== "string" || typeof requestPayload["type"] !== "string") {
-            throw new room_server_client_js_1.RoomServerException("invalid secrets.request_secret payload");
-          }
-          Promise.resolve(this.secretRequestHandler({
-            requestId,
-            url: requestPayload["url"],
-            type: requestPayload["type"],
-            delegateTo: typeof requestPayload["delegate_to"] === "string" ? requestPayload["delegate_to"] : null
-          })).catch((error) => {
-            console.warn("Secret request handler threw", error);
-          });
+        async insert({ database, table, records, namespace }) {
+          await this.insertStream({ database, table, chunks: [records], namespace });
         }
-        async provideOAuthAuthorization({ requestId, code }) {
-          const response = await this.invoke("provide_oauth_authorization", {
-            request_id: requestId,
-            code,
-            error: null
-          });
-          if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
-          }
-          throw this.unexpectedResponse("provide_oauth_authorization");
+        async insertStream({ database, table, chunks, namespace }) {
+          const input = new SqliteArrowWriteInputStream({
+            kind: "start",
+            database,
+            table,
+            namespace: namespace ?? null
+          }, chunks);
+          await this.drainWriteStream("insert", input);
         }
-        async rejectOAuthAuthorization({ requestId, error }) {
-          const response = await this.invoke("provide_oauth_authorization", {
-            request_id: requestId,
-            code: null,
-            error
+        async update({ database, table, where, values, params, namespace }) {
+          const response = await this.invoke("update", {
+            database,
+            table,
+            where,
+            values: Object.entries(values).map(([column, value]) => ({ column, value_json: JSON.stringify(encodeRecordValue(value)) })),
+            params: params ?? null,
+            namespace: namespace ?? null
           });
-          if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
+          if (!(response instanceof response_js_1.JsonContent) || typeof response.json.rows_affected !== "number") {
+            throw this.unexpectedResponseError("update");
           }
-          throw this.unexpectedResponse("provide_oauth_authorization");
+          return response.json.rows_affected;
         }
-        async provideSecret({ requestId, data }) {
-          const response = await this.invoke("provide_secret", new response_js_1.BinaryContent({
-            data,
-            headers: {
-              request_id: requestId,
-              error: null
-            }
-          }));
-          if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
+        async delete({ database, table, where, params, namespace }) {
+          const response = await this.invoke("delete", { database, table, where, params: params ?? null, namespace: namespace ?? null });
+          if (!(response instanceof response_js_1.JsonContent) || typeof response.json.rows_affected !== "number") {
+            throw this.unexpectedResponseError("delete");
           }
-          throw this.unexpectedResponse("provide_secret");
+          return response.json.rows_affected;
         }
-        async rejectSecret({ requestId, error }) {
-          const response = await this.invoke("provide_secret", new response_js_1.BinaryContent({
-            data: new Uint8Array(0),
-            headers: {
-              request_id: requestId,
-              error
-            }
-          }));
-          if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
+        async search({ database, table, where, params, offset, limit, select, namespace }) {
+          const results = [];
+          for await (const chunk of this.searchStream({ database, table, where, params, offset, limit, select, namespace })) {
+            results.push(chunk);
           }
-          throw this.unexpectedResponse("provide_secret");
+          return results;
         }
-        async getOfflineOAuthToken({ connector, oauth, delegatedTo, delegatedBy }) {
-          const response = await this.invoke("get_offline_oauth_token", {
-            connector: this.serializeConnectorRef(connector),
-            oauth: this.serializeOAuthConfig(oauth),
-            delegated_to: delegatedTo ?? null,
-            delegated_by: delegatedBy ?? null
-          });
-          return this.parseAccessToken("get_offline_oauth_token", response);
+        async searchTable({ database, table, where, params, offset, limit, select, namespace }) {
+          return tableFromChunks(await this.search({ database, table, where, params, offset, limit, select, namespace }));
         }
-        async requestOAuthToken({ connector, oauth, timeout = 60 * 5, fromParticipantId, redirectUri, delegateTo }) {
-          const response = await this.invoke("request_oauth_token", {
-            connector: this.serializeConnectorRef(connector),
-            oauth: this.serializeOAuthConfig(oauth),
-            redirect_uri: typeof redirectUri === "string" ? redirectUri : redirectUri.toString(),
-            timeout,
-            participant_id: fromParticipantId,
-            delegate_to: delegateTo ?? null
+        async *searchStream({ database, table, where, params, offset, limit, select, namespace }) {
+          yield* this.streamArrow("search", {
+            kind: "start",
+            database,
+            table,
+            where: buildWhereClause(where),
+            params: params ?? null,
+            offset: offset ?? null,
+            limit: limit ?? null,
+            select: select ?? null,
+            namespace: namespace ?? null
           });
-          return this.parseAccessToken("request_oauth_token", response);
         }
-        async listSecrets() {
-          const response = await this.invoke("list_secrets", {});
-          if (!(response instanceof response_js_1.JsonContent)) {
-            throw this.unexpectedResponse("list_secrets");
-          }
-          const secrets = response.json["secrets"];
-          if (!Array.isArray(secrets)) {
-            throw this.unexpectedResponse("list_secrets");
+        async count({ database, table, where, params, namespace }) {
+          const response = await this.invoke("count", {
+            database,
+            table,
+            where: buildWhereClause(where),
+            params: params ?? null,
+            namespace: namespace ?? null
+          });
+          if (!(response instanceof response_js_1.JsonContent) || typeof response.json.count !== "number" || !Number.isInteger(response.json.count)) {
+            throw this.unexpectedResponseError("count");
           }
-          return secrets.map((item) => this.parseSecretInfo(item));
+          return response.json.count;
         }
-        async exists({ secretId, delegatedTo, forIdentity }) {
-          const response = await this.invoke("exists", {
-            secret_id: secretId,
-            delegated_to: delegatedTo ?? null,
-            for_identity: forIdentity ?? null
-          });
-          if (!(response instanceof response_js_1.JsonContent) || typeof response.json["exists"] !== "boolean") {
-            throw this.unexpectedResponse("exists");
+        async sql({ database, query, params, namespace }) {
+          const results = [];
+          for await (const chunk of this.sqlStream({ database, query, params, namespace })) {
+            results.push(chunk);
           }
-          return response.json["exists"];
+          return results;
         }
-        async deleteSecret({ secretId, delegatedTo }) {
-          const response = await this.invoke("delete_secret", {
-            id: secretId,
-            delegated_to: delegatedTo ?? null
-          });
-          if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
+        async sqlTable({ database, query, params, namespace }) {
+          return tableFromChunks(await this.sql({ database, query, params, namespace }));
+        }
+        async openSqlQuery({ database, query, params, namespace }) {
+          const response = await this.invokeContent("open_sql_query", new response_js_1.BinaryContent({
+            data: new Uint8Array(),
+            headers: { database, query, params: params ?? null, namespace: namespace ?? null }
+          }));
+          if (!(response instanceof response_js_1.BinaryContent)) {
+            throw this.unexpectedResponseError("open_sql_query");
+          }
+          const queryId = response.headers.query_id;
+          if (typeof queryId !== "string" || queryId === "") {
+            throw this.unexpectedResponseError("open_sql_query");
           }
-          throw this.unexpectedResponse("delete_secret");
+          return {
+            schema: schemaFromIPCBytes(response.data),
+            kind: "query",
+            queryId
+          };
         }
-        async deleteRequestedSecret({ url, type, delegatedTo }) {
-          const response = await this.invoke("delete_requested_secret", {
-            url,
-            type,
-            delegated_to: delegatedTo ?? null
-          });
-          if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
+        async executeSql({ database, query, params, namespace }) {
+          const response = await this.invokeContent("execute_sql", new response_js_1.BinaryContent({
+            data: new Uint8Array(),
+            headers: { database, query, params: params ?? null, namespace: namespace ?? null }
+          }));
+          if (response instanceof response_js_1.BinaryContent) {
+            if (response.headers.kind !== "query") {
+              throw this.unexpectedResponseError("execute_sql");
+            }
+            const queryId = response.headers.query_id;
+            if (typeof queryId !== "string" || queryId === "") {
+              throw this.unexpectedResponseError("execute_sql");
+            }
+            return {
+              kind: "query",
+              schema: schemaFromIPCBytes(response.data),
+              queryId
+            };
+          }
+          if (response instanceof response_js_1.JsonContent) {
+            if (response.json.kind !== "statement" || typeof response.json.rows_affected !== "number" || !Number.isInteger(response.json.rows_affected)) {
+              throw this.unexpectedResponseError("execute_sql");
+            }
+            return {
+              kind: "statement",
+              rowsAffected: response.json.rows_affected
+            };
           }
-          throw this.unexpectedResponse("delete_requested_secret");
+          throw this.unexpectedResponseError("execute_sql");
         }
-        async requestSecret({ fromParticipantId, url, type, timeout = 60 * 5, delegateTo }) {
-          const response = await this.invoke("request_secret", {
-            url,
-            type,
-            participant_id: fromParticipantId,
-            timeout,
-            delegate_to: delegateTo ?? null
-          });
-          if (response instanceof response_js_1.FileContent) {
-            return response.data;
+        async *sqlStream({ database, query, params, namespace }) {
+          const result = await this.executeSql({ database, query, params, namespace });
+          if (result.kind === "statement") {
+            throw new room_server_client_js_1.RoomServerException(`SQL statement did not return rows; rows_affected=${result.rowsAffected}`);
+          }
+          try {
+            yield* this.readSqlQuery({ queryId: result.queryId });
+          } finally {
+            await this.closeSqlQuery({ queryId: result.queryId });
           }
-          throw this.unexpectedResponse("request_secret");
         }
-        async setSecret({ secretId, type, mimeType, name, delegatedTo, forIdentity, data }) {
-          const response = await this.invoke("set_secret", new response_js_1.BinaryContent({
-            data,
-            headers: {
-              secret_id: secretId ?? null,
-              type: type ?? mimeType ?? null,
-              name: name ?? null,
-              delegated_to: delegatedTo ?? null,
-              for_identity: forIdentity ?? null,
-              has_data: true
-            }
-          }));
-          if (response instanceof response_js_1.EmptyContent || response instanceof response_js_1.JsonContent) {
-            return;
+        async *readSqlQuery({ queryId }) {
+          yield* this.streamArrow("read_sql_query", { kind: "start", query_id: queryId });
+        }
+        async closeSqlQuery({ queryId }) {
+          const response = await this.invoke("close_sql_query", { query_id: queryId });
+          if (!(response instanceof response_js_1.EmptyContent)) {
+            throw this.unexpectedResponseError("close_sql_query");
           }
-          throw this.unexpectedResponse("set_secret");
         }
-        async getSecret({ secretId, type, name, delegatedTo }) {
-          const response = await this.invoke("get_secret", {
-            secret_id: secretId ?? null,
-            type: type ?? null,
-            name: name ?? null,
-            delegated_to: delegatedTo ?? null
-          });
-          if (response instanceof response_js_1.EmptyContent) {
-            return null;
+        async cancelSqlQuery({ queryId }) {
+          const response = await this.invoke("cancel_sql_query", { query_id: queryId });
+          if (!(response instanceof response_js_1.JsonContent) || !["cancelled", "cancelling", "not_cancellable"].includes(response.json.status)) {
+            throw this.unexpectedResponseError("cancel_sql_query");
           }
-          if (response instanceof response_js_1.FileContent) {
-            return response;
+          return { status: response.json.status };
+        }
+        async executeSqlStatement({ database, query, params, namespace }) {
+          const response = await this.invokeContent("execute_sql_statement", new response_js_1.BinaryContent({
+            data: new Uint8Array(),
+            headers: { database, query, params: params ?? null, namespace: namespace ?? null }
+          }));
+          if (!(response instanceof response_js_1.JsonContent) || typeof response.json.rows_affected !== "number" || !Number.isInteger(response.json.rows_affected)) {
+            throw this.unexpectedResponseError("execute_sql_statement");
           }
-          throw this.unexpectedResponse("get_secret");
+          return response.json.rows_affected;
         }
       };
-      exports.SecretsClient = SecretsClient;
+      exports.SqliteClient = SqliteClient;
     }
   });
 
@@ -45159,6 +45462,7 @@ ${newlined}
         }
         const state = value["state"];
         const containerId = value["container_id"];
+        const eventsRaw = value["events"];
         return {
           serviceId: value["service_id"],
           state: typeof state === "string" ? state : "unknown",
@@ -45167,7 +45471,23 @@ ${newlined}
           startedAt: toOptionalNumber(value["started_at"]),
           restartCount: toOptionalInteger(value["restart_count"]) ?? 0,
           lastExitCode: toOptionalInteger(value["last_exit_code"]),
-          lastExitAt: toOptionalNumber(value["last_exit_at"])
+          lastExitAt: toOptionalNumber(value["last_exit_at"]),
+          lastStartError: typeof value["last_start_error"] === "string" ? value["last_start_error"] : void 0,
+          lastStartErrorAt: toOptionalNumber(value["last_start_error_at"]),
+          events: Array.isArray(eventsRaw) ? eventsRaw.map((event) => parseServiceRuntimeEvent(event)) : []
+        };
+      }
+      function parseServiceRuntimeEvent(value) {
+        if (!isRecord(value)) {
+          throw new room_server_client_js_1.RoomServerException("unexpected return type from services.list");
+        }
+        return {
+          type: typeof value["type"] === "string" ? value["type"] : "Normal",
+          reason: typeof value["reason"] === "string" ? value["reason"] : "Unknown",
+          message: typeof value["message"] === "string" ? value["message"] : "",
+          count: toOptionalInteger(value["count"]) ?? 1,
+          firstTimestamp: toOptionalNumber(value["first_timestamp"]) ?? 0,
+          lastTimestamp: toOptionalNumber(value["last_timestamp"]) ?? 0
         };
       }
       function parseServiceSpecJson(value) {
@@ -46209,6 +46529,7 @@ ${newlined}
       exports.RoomClient = exports.RoomProtocolProxy = void 0;
       var completer_js_1 = require_completer();
       var datasets_client_js_1 = require_datasets_client();
+      var sqlite_client_js_1 = require_sqlite_client();
       var developer_client_js_1 = require_developer_client();
       var event_emitter_js_1 = require_event_emitter();
       var messaging_client_js_1 = require_messaging_client();
@@ -46219,7 +46540,6 @@ ${newlined}
       var response_js_1 = require_response();
       var room_event_js_1 = require_room_event();
       var room_server_client_js_1 = require_room_server_client();
-      var secrets_client_js_1 = require_secrets_client();
       var services_client_js_1 = require_services_client();
       var storage_client_js_1 = require_storage_client();
       var stream_controller_js_1 = require_stream_controller();
@@ -46409,7 +46729,7 @@ ${newlined}
       };
       exports.RoomProtocolProxy = RoomProtocolProxy;
       var RoomClient = class _RoomClient {
-        constructor({ protocolFactory = null, reconnectTimeout = null, oauthTokenRequestHandler, secretRequestHandler } = {}) {
+        constructor({ protocolFactory = null, reconnectTimeout = null } = {}) {
           this._entered = false;
           this._allowDisconnectedRequests = false;
           this._eventsController = new stream_controller_js_1.StreamController();
@@ -46456,22 +46776,16 @@ ${newlined}
           this.messaging = new messaging_client_js_1.MessagingClient({ room: this });
           this.queues = new queues_client_js_1.QueuesClient({ room: this });
           this.datasets = new datasets_client_js_1.DatasetsClient({ room: this });
+          this.sqlite = new sqlite_client_js_1.SqliteClient({ room: this });
           this.agents = new agent_client_js_1.AgentsClient({ room: this });
-          this.secrets = new secrets_client_js_1.SecretsClient({
-            room: this,
-            oauthTokenRequestHandler,
-            secretRequestHandler
-          });
           this.containers = new containers_client_js_1.ContainersClient({ room: this });
           this.memory = new memory_client_js_1.MemoryClient({ room: this });
           this.services = new services_client_js_1.ServicesClient({ room: this });
         }
-        static withIAP({ url = "./.well-known/meshagent/room/connect", reconnectTimeout = null, oauthTokenRequestHandler, secretRequestHandler } = {}) {
+        static withIAP({ url = "./.well-known/meshagent/room/connect", reconnectTimeout = null } = {}) {
           return new _RoomClient({
             protocolFactory: () => protocol_js_1.WebSocketClientProtocol.withIAP({ url }),
-            reconnectTimeout,
-            oauthTokenRequestHandler,
-            secretRequestHandler
+            reconnectTimeout
           });
         }
         get localParticipant() {
@@ -47905,30 +48219,19 @@ ${newlined}
           if (connector == null && this.oauth == null) {
             return true;
           }
-          const token = await room.secrets.getOfflineOAuthToken({
-            connector,
-            oauth: this.oauth,
-            delegatedTo: agentName
-          });
-          return token != null;
+          void room;
+          void agentName;
+          throw new Error("OAuth MCP connections require proxy-backed user secrets");
         }
         async authenticate(client, agent, redirectUri) {
           const connector = this.buildConnectorRef();
           if (connector == null && this.oauth == null) {
             return null;
           }
-          const localParticipant = client.localParticipant;
-          if (localParticipant == null) {
-            throw new Error("Connector.authenticate requires a local participant");
-          }
-          const agentName = agent.getAttribute("name");
-          return await client.secrets.requestOAuthToken({
-            fromParticipantId: localParticipant.id,
-            connector,
-            oauth: this.oauth,
-            redirectUri,
-            delegateTo: agentName == null ? null : String(agentName)
-          });
+          void client;
+          void agent;
+          void redirectUri;
+          throw new Error("OAuth MCP connections require proxy-backed user secrets");
         }
       };
       exports.Connector = Connector;
@@ -47977,7 +48280,25 @@ ${newlined}
         const fragment = baseUrl.hash;
         return `${baseUrl.protocol}//${userInfo}${bracketIpv6Host(baseUrl.hostname)}:${portValue}${joinedPath}${query}${fragment}`;
       }
-      function mcpConnectorsFromRoomServices({ services, agentName }) {
+      function proxyMcpServerUrl({ serverUrl, useProxySecret, proxyConfig }) {
+        const secretId = useProxySecret?.trim();
+        if (serverUrl == null || secretId == null || secretId.length === 0 || proxyConfig == null) {
+          return serverUrl;
+        }
+        const apiUrl = proxyConfig.apiUrl.trim().replace(/\/+$/, "");
+        if (apiUrl.length === 0 || proxyConfig.apiKey.trim().length === 0) {
+          throw new Error("meshagent_proxy_config requires apiUrl and apiKey");
+        }
+        const url = new URL(`${apiUrl}/proxy-request`);
+        url.searchParams.set("url", serverUrl);
+        url.searchParams.set("secret-id", secretId);
+        const user = proxyConfig.user?.trim();
+        if (user != null && user.length > 0) {
+          url.searchParams.set("user", user);
+        }
+        return url.toString();
+      }
+      function mcpConnectorsFromRoomServices({ services, agentName, meshagentProxyConfig }) {
         const connectors = [];
         for (const service of services) {
           const filter = service.metadata.annotations?.["meshagent.agent.filter"];
@@ -47994,12 +48315,22 @@ ${newlined}
                 name: mcp.label,
                 server: new MCPServer({
                   serverLabel: mcp.label,
-                  serverUrl: roomServiceMcpServerUrl({ service, port, endpoint }),
-                  headers: headersFromEndpointSpec(mcp.headers),
+                  serverUrl: proxyMcpServerUrl({
+                    serverUrl: roomServiceMcpServerUrl({ service, port, endpoint }),
+                    useProxySecret: mcp.use_proxy_secret,
+                    proxyConfig: meshagentProxyConfig
+                  }),
+                  headers: mcp.use_proxy_secret != null && meshagentProxyConfig != null ? [
+                    ...headersFromEndpointSpec(mcp.headers) ?? [],
+                    new MCPHeader({
+                      name: "Authorization",
+                      value: `Bearer ${meshagentProxyConfig.apiKey}`
+                    })
+                  ] : headersFromEndpointSpec(mcp.headers),
                   requireApproval: mcp.require_approval,
                   openaiConnectorId: mcp.openai_connector_id
                 }),
-                oauth: mcp.oauth
+                oauth: mcp.use_proxy_secret != null ? void 0 : mcp.oauth
               }));
             }
           }
@@ -48181,7 +48512,7 @@ ${newlined}
       __exportStar(require_schema3(), exports);
       __exportStar(require_storage_client(), exports);
       __exportStar(require_services_client(), exports);
-      __exportStar(require_secrets_client(), exports);
+      __exportStar(require_sqlite_client(), exports);
       __exportStar(require_stream_controller(), exports);
       __exportStar(require_sync_client(), exports);
       __exportStar(require_api_keys(), exports);