@meshagent/meshagent 0.36.3 → 0.37.0

package/dist/browser/participant-token.js

@@ -1,22 +1,90 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ParticipantToken = exports.ParticipantGrant = exports.ApiScope = exports.SecretsGrant = exports.AdminGrant = exports.DeveloperGrant = exports.ContainersGrant = exports.StorageGrant = exports.StoragePathGrant = exports.SyncGrant = exports.SyncPathGrant = exports.DatabaseGrant = exports.TableGrant = exports.MessagingGrant = exports.QueuesGrant = exports.LivekitGrant = exports.AgentsGrant = void 0;
+exports.ParticipantToken = exports.ParticipantGrant = exports.ApiScope = exports.LLMGrant = exports.ServicesGrant = exports.TunnelsGrant = exports.SecretsGrant = exports.OAuthEndpoint = exports.AdminGrant = exports.DeveloperGrant = exports.ContainersGrant = exports.ContainerRegistryGrant = exports.StorageGrant = exports.StoragePathGrant = exports.SyncGrant = exports.SyncPathGrant = exports.MemoryGrant = exports.MemoryEntryGrant = exports.MemoryPermissions = exports.DatabaseGrant = exports.TableGrant = exports.MessagingGrant = exports.QueuesGrant = exports.LivekitGrant = exports.AgentsGrant = void 0;
 const jose_1 = require("jose");
 const api_keys_1 = require("./api_keys");
+const version_1 = require("./version");
+function matchesGrantPattern(patterns, value, allowIfUnset) {
+    if (!patterns) {
+        return allowIfUnset;
+    }
+    return patterns.some((pattern) => value === pattern
+        || (pattern.endsWith("*")
+            && value.startsWith(pattern.slice(0, -1))));
+}
 function getEnvValue(name) {
     if (typeof process === "undefined") {
         return undefined;
     }
     return process.env?.[name];
 }
+function normalizeNamespace(namespace) {
+    return namespace ?? [];
+}
+function namespacesEqual(left, right) {
+    const normalizedLeft = normalizeNamespace(left);
+    const normalizedRight = normalizeNamespace(right);
+    if (normalizedLeft.length !== normalizedRight.length) {
+        return false;
+    }
+    return normalizedLeft.every((value, index) => value === normalizedRight[index]);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function asStringList(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string")
+        ? value
+        : undefined;
+}
 class AgentsGrant {
-    constructor({ registerAgent, registerPublicToolkit, registerPrivateToolkit, call, useAgents, useTools, } = {}) {
+    constructor({ registerAgent, registerPublicToolkit, registerPrivateToolkit, call, useAgents, useTools, allowedToolkits, } = {}) {
         this.registerAgent = registerAgent ?? true;
         this.registerPublicToolkit = registerPublicToolkit ?? true;
         this.registerPrivateToolkit = registerPrivateToolkit ?? true;
         this.call = call ?? true;
         this.useAgents = useAgents ?? true;
         this.useTools = useTools ?? true;
+        this.allowedToolkits = allowedToolkits;
+    }
+    toJSON() {
+        const json = {};
+        if (this.registerAgent !== true) {
+            json["register_agent"] = this.registerAgent;
+        }
+        if (this.registerPublicToolkit !== true) {
+            json["register_public_toolkit"] = this.registerPublicToolkit;
+        }
+        if (this.registerPrivateToolkit !== true) {
+            json["register_private_toolkit"] = this.registerPrivateToolkit;
+        }
+        if (this.call !== true) {
+            json["call"] = this.call;
+        }
+        if (this.useAgents !== true) {
+            json["use_agents"] = this.useAgents;
+        }
+        if (this.useTools !== true) {
+            json["use_tools"] = this.useTools;
+        }
+        if (this.allowedToolkits !== undefined) {
+            json["allowed_toolkits"] = this.allowedToolkits;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new AgentsGrant();
+        }
+        return new AgentsGrant({
+            registerAgent: obj.register_agent ?? obj.registerAgent,
+            registerPublicToolkit: obj.register_public_toolkit ?? obj.registerPublicToolkit,
+            registerPrivateToolkit: obj.register_private_toolkit ?? obj.registerPrivateToolkit,
+            call: obj.call,
+            useAgents: obj.use_agents ?? obj.useAgents,
+            useTools: obj.use_tools ?? obj.useTools,
+            allowedToolkits: asStringList(obj.allowed_toolkits ?? obj.allowedToolkits),
+        });
     }
 }
 exports.AgentsGrant = AgentsGrant;
@@ -27,94 +95,444 @@ class LivekitGrant {
     canJoinBreakoutRoom(name) {
         return !this.breakoutRooms || this.breakoutRooms.includes(name);
     }
+    toJSON() {
+        const json = {};
+        if (this.breakoutRooms !== undefined) {
+            json["breakout_rooms"] = this.breakoutRooms;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new LivekitGrant();
+        }
+        return new LivekitGrant({
+            breakoutRooms: asStringList(obj.breakout_rooms ?? obj.breakoutRooms),
+        });
+    }
 }
 exports.LivekitGrant = LivekitGrant;
 class QueuesGrant {
-    constructor({ send, receive, list } = {}) {
-        this.list = true;
+    constructor({ send, receive, list, } = {}) {
         this.send = send;
         this.receive = receive;
         this.list = list ?? true;
     }
-    canSend(q) {
-        return !this.send || this.send.includes(q);
+    canSend(queue) {
+        return !this.send || this.send.includes(queue);
     }
-    canReceive(q) {
-        return !this.receive || this.receive.includes(q);
+    canReceive(queue) {
+        return !this.receive || this.receive.includes(queue);
+    }
+    toJSON() {
+        const json = {};
+        if (this.send !== undefined) {
+            json["send"] = this.send;
+        }
+        if (this.receive !== undefined) {
+            json["receive"] = this.receive;
+        }
+        if (this.list !== true) {
+            json["list"] = this.list;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new QueuesGrant();
+        }
+        return new QueuesGrant({
+            send: asStringList(obj.send),
+            receive: asStringList(obj.receive),
+            list: obj.list,
+        });
     }
 }
 exports.QueuesGrant = QueuesGrant;
 class MessagingGrant {
-    constructor({ broadcast, list, send } = {}) {
+    constructor({ broadcast, list, send, } = {}) {
         this.broadcast = broadcast ?? true;
         this.list = list ?? true;
         this.send = send ?? true;
     }
+    toJSON() {
+        const json = {};
+        if (this.broadcast !== true) {
+            json["broadcast"] = this.broadcast;
+        }
+        if (this.list !== true) {
+            json["list"] = this.list;
+        }
+        if (this.send !== true) {
+            json["send"] = this.send;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new MessagingGrant();
+        }
+        return new MessagingGrant({
+            broadcast: obj.broadcast,
+            list: obj.list,
+            send: obj.send,
+        });
+    }
 }
 exports.MessagingGrant = MessagingGrant;
 class TableGrant {
-    constructor({ name, write, read, alter }) {
-        this.write = false;
-        this.read = true;
-        this.alter = false;
+    constructor({ name, namespace, write, read, alter, }) {
         this.name = name;
+        this.namespace = namespace;
         this.write = write ?? false;
         this.read = read ?? true;
         this.alter = alter ?? false;
     }
+    toJSON() {
+        const json = {
+            name: this.name,
+        };
+        if (this.namespace !== undefined) {
+            json["namespace"] = this.namespace;
+        }
+        if (this.write !== false) {
+            json["write"] = this.write;
+        }
+        if (this.read !== true) {
+            json["read"] = this.read;
+        }
+        if (this.alter !== false) {
+            json["alter"] = this.alter;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.name !== "string") {
+            throw new Error("TableGrant requires a name");
+        }
+        return new TableGrant({
+            name: obj.name,
+            namespace: asStringList(obj.namespace),
+            write: obj.write,
+            read: obj.read,
+            alter: obj.alter,
+        });
+    }
 }
 exports.TableGrant = TableGrant;
 class DatabaseGrant {
-    constructor({ tables, listTables } = {}) {
-        this.listTables = true;
+    constructor({ tables, listTables, } = {}) {
         this.tables = tables;
         this.listTables = listTables ?? true;
     }
-    _match(table) {
-        if (!this.tables)
-            return undefined;
-        return this.tables.find(t => t.name === table);
+    matchingTables(table, namespace) {
+        if (this.tables === undefined) {
+            return [];
+        }
+        return this.tables.filter((tableGrant) => {
+            if (tableGrant.name !== table) {
+                return false;
+            }
+            if (tableGrant.namespace === undefined) {
+                return true;
+            }
+            return namespacesEqual(tableGrant.namespace, namespace);
+        });
     }
-    canWrite(table) {
-        const t = this._match(table);
-        return t ? t.write : this.tables === undefined;
+    canWrite(table, namespace) {
+        if (this.tables === undefined) {
+            return true;
+        }
+        const matches = this.matchingTables(table, namespace);
+        if (matches.length === 0) {
+            return false;
+        }
+        return matches.some((tableGrant) => tableGrant.write);
     }
-    canRead(table) {
-        const t = this._match(table);
-        return t ? t.read : this.tables === undefined;
+    canRead(table, namespace) {
+        if (this.tables === undefined) {
+            return true;
+        }
+        const matches = this.matchingTables(table, namespace);
+        if (matches.length === 0) {
+            return false;
+        }
+        return matches.some((tableGrant) => tableGrant.read);
     }
-    canAlter(table) {
-        const t = this._match(table);
-        return t ? t.alter : this.tables === undefined;
+    canAlter(table, namespace) {
+        if (this.tables === undefined) {
+            return true;
+        }
+        const matches = this.matchingTables(table, namespace);
+        if (matches.length === 0) {
+            return false;
+        }
+        return matches.some((tableGrant) => tableGrant.alter);
+    }
+    canAccess(table, namespace) {
+        return (this.canRead(table, namespace)
+            || this.canWrite(table, namespace)
+            || this.canAlter(table, namespace));
+    }
+    toJSON() {
+        const json = {};
+        if (this.tables !== undefined) {
+            json["tables"] = this.tables.map((tableGrant) => tableGrant.toJSON());
+        }
+        if (this.listTables !== true) {
+            json["list_tables"] = this.listTables;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new DatabaseGrant();
+        }
+        return new DatabaseGrant({
+            tables: Array.isArray(obj.tables)
+                ? obj.tables.map((tableGrant) => TableGrant.fromJSON(tableGrant))
+                : undefined,
+            listTables: obj.list_tables ?? obj.listTables,
+        });
     }
 }
 exports.DatabaseGrant = DatabaseGrant;
+class MemoryPermissions {
+    constructor({ create, drop, inspect, query, upsert, ingest, recall, optimize, } = {}) {
+        this.create = create ?? true;
+        this.drop = drop ?? true;
+        this.inspect = inspect ?? true;
+        this.query = query ?? true;
+        this.upsert = upsert ?? true;
+        this.ingest = ingest ?? true;
+        this.recall = recall ?? true;
+        this.optimize = optimize ?? true;
+    }
+    toJSON() {
+        const json = {};
+        if (this.create !== true) {
+            json["create"] = this.create;
+        }
+        if (this.drop !== true) {
+            json["drop"] = this.drop;
+        }
+        if (this.inspect !== true) {
+            json["inspect"] = this.inspect;
+        }
+        if (this.query !== true) {
+            json["query"] = this.query;
+        }
+        if (this.upsert !== true) {
+            json["upsert"] = this.upsert;
+        }
+        if (this.ingest !== true) {
+            json["ingest"] = this.ingest;
+        }
+        if (this.recall !== true) {
+            json["recall"] = this.recall;
+        }
+        if (this.optimize !== true) {
+            json["optimize"] = this.optimize;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new MemoryPermissions();
+        }
+        return new MemoryPermissions({
+            create: obj.create,
+            drop: obj.drop,
+            inspect: obj.inspect,
+            query: obj.query,
+            upsert: obj.upsert,
+            ingest: obj.ingest,
+            recall: obj.recall,
+            optimize: obj.optimize,
+        });
+    }
+}
+exports.MemoryPermissions = MemoryPermissions;
+class MemoryEntryGrant {
+    constructor({ name, namespace, permissions, }) {
+        this.name = name;
+        this.namespace = namespace;
+        this.permissions = permissions ?? new MemoryPermissions();
+    }
+    toJSON() {
+        const json = {
+            name: this.name,
+        };
+        if (this.namespace !== undefined) {
+            json["namespace"] = this.namespace;
+        }
+        json["permissions"] = this.permissions.toJSON();
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.name !== "string") {
+            throw new Error("MemoryEntryGrant requires a name");
+        }
+        return new MemoryEntryGrant({
+            name: obj.name,
+            namespace: asStringList(obj.namespace),
+            permissions: MemoryPermissions.fromJSON(obj.permissions),
+        });
+    }
+}
+exports.MemoryEntryGrant = MemoryEntryGrant;
+class MemoryGrant {
+    constructor({ list, memories, } = {}) {
+        this.list = list ?? true;
+        this.memories = memories;
+    }
+    matchingMemories(name, namespace) {
+        if (this.memories === undefined) {
+            return [];
+        }
+        return this.memories.filter((memoryGrant) => {
+            if (memoryGrant.name !== name) {
+                return false;
+            }
+            if (memoryGrant.namespace === undefined) {
+                return true;
+            }
+            return namespacesEqual(memoryGrant.namespace, namespace);
+        });
+    }
+    can(name, namespace, permission) {
+        if (this.memories === undefined) {
+            return true;
+        }
+        const matches = this.matchingMemories(name, namespace);
+        if (matches.length === 0) {
+            return false;
+        }
+        return matches.some((memoryGrant) => memoryGrant.permissions[permission]);
+    }
+    canCreate(name, namespace) {
+        return this.can(name, namespace, "create");
+    }
+    canDrop(name, namespace) {
+        return this.can(name, namespace, "drop");
+    }
+    canInspect(name, namespace) {
+        return this.can(name, namespace, "inspect");
+    }
+    canQuery(name, namespace) {
+        return this.can(name, namespace, "query");
+    }
+    canUpsert(name, namespace) {
+        return this.can(name, namespace, "upsert");
+    }
+    canIngest(name, namespace) {
+        return this.can(name, namespace, "ingest");
+    }
+    canRecall(name, namespace) {
+        return this.can(name, namespace, "recall");
+    }
+    canOptimize(name, namespace) {
+        return this.can(name, namespace, "optimize");
+    }
+    canAccessExisting(name, namespace) {
+        return (this.canDrop(name, namespace)
+            || this.canInspect(name, namespace)
+            || this.canQuery(name, namespace)
+            || this.canUpsert(name, namespace)
+            || this.canIngest(name, namespace)
+            || this.canRecall(name, namespace)
+            || this.canOptimize(name, namespace));
+    }
+    toJSON() {
+        const json = {};
+        if (this.list !== true) {
+            json["list"] = this.list;
+        }
+        if (this.memories !== undefined) {
+            json["memories"] = this.memories.map((memoryGrant) => memoryGrant.toJSON());
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new MemoryGrant();
+        }
+        return new MemoryGrant({
+            list: obj.list,
+            memories: Array.isArray(obj.memories)
+                ? obj.memories.map((memoryGrant) => MemoryEntryGrant.fromJSON(memoryGrant))
+                : undefined,
+        });
+    }
+}
+exports.MemoryGrant = MemoryGrant;
 class SyncPathGrant {
     constructor({ path, readOnly }) {
         this.path = path;
         this.readOnly = readOnly ?? false;
     }
+    toJSON() {
+        const json = {
+            path: this.path,
+        };
+        if (this.readOnly !== false) {
+            json["read_only"] = this.readOnly;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.path !== "string") {
+            throw new Error("SyncPathGrant requires a path");
+        }
+        return new SyncPathGrant({
+            path: obj.path,
+            readOnly: obj.read_only ?? obj.readOnly,
+        });
+    }
 }
 exports.SyncPathGrant = SyncPathGrant;
 class SyncGrant {
     constructor({ paths } = {}) {
         this.paths = paths;
     }
-    matches(p, path) {
-        return p.path === path || (p.path.endsWith("*") && path.startsWith(p.path.slice(0, -1)));
+    matches(pathGrant, path) {
+        return pathGrant.path === path
+            || (pathGrant.path.endsWith("*")
+                && path.startsWith(pathGrant.path.slice(0, -1)));
     }
     canRead(path) {
-        if (this.paths) {
-            return this.paths.some(p => this.matches(p, path));
+        if (this.paths === undefined) {
+            return true;
         }
-        return true;
+        return this.paths.some((pathGrant) => this.matches(pathGrant, path));
     }
     canWrite(path) {
-        if (this.paths) {
-            const p = this.paths.find(pp => this.matches(pp, path));
-            return p ? !p.readOnly : false;
+        if (this.paths === undefined) {
+            return true;
         }
-        return true;
+        for (const pathGrant of this.paths) {
+            if (this.matches(pathGrant, path)) {
+                return !pathGrant.readOnly;
+            }
+        }
+        return false;
+    }
+    toJSON() {
+        const json = {};
+        if (this.paths !== undefined) {
+            json["paths"] = this.paths.map((pathGrant) => pathGrant.toJSON());
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new SyncGrant();
+        }
+        return new SyncGrant({
+            paths: Array.isArray(obj.paths)
+                ? obj.paths.map((pathGrant) => SyncPathGrant.fromJSON(pathGrant))
+                : undefined,
+        });
     }
 }
 exports.SyncGrant = SyncGrant;
@@ -123,46 +541,190 @@ class StoragePathGrant {
         this.path = path;
         this.readOnly = readOnly ?? false;
     }
+    toJSON() {
+        const json = {
+            path: this.path,
+        };
+        if (this.readOnly !== false) {
+            json["read_only"] = this.readOnly;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.path !== "string") {
+            throw new Error("StoragePathGrant requires a path");
+        }
+        return new StoragePathGrant({
+            path: obj.path,
+            readOnly: obj.read_only ?? obj.readOnly,
+        });
+    }
 }
 exports.StoragePathGrant = StoragePathGrant;
 class StorageGrant {
     constructor({ paths } = {}) {
         this.paths = paths;
     }
-    matches(p, path) {
-        return path.startsWith(p.path);
-    }
     canRead(path) {
-        if (!this.paths)
+        if (this.paths === undefined) {
             return true;
-        return this.paths.some(p => this.matches(p, path));
+        }
+        return this.paths.some((pathGrant) => path.startsWith(pathGrant.path));
     }
     canWrite(path) {
-        if (!this.paths)
+        if (this.paths === undefined) {
             return true;
-        const p = this.paths.find(pp => this.matches(pp, path));
-        return p ? !p.readOnly : false;
+        }
+        for (const pathGrant of this.paths) {
+            if (path.startsWith(pathGrant.path)) {
+                return !pathGrant.readOnly;
+            }
+        }
+        return false;
+    }
+    toJSON() {
+        const json = {};
+        if (this.paths !== undefined) {
+            json["paths"] = this.paths.map((pathGrant) => pathGrant.toJSON());
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new StorageGrant();
+        }
+        return new StorageGrant({
+            paths: Array.isArray(obj.paths)
+                ? obj.paths.map((pathGrant) => StoragePathGrant.fromJSON(pathGrant))
+                : undefined,
+        });
     }
 }
 exports.StorageGrant = StorageGrant;
+class ContainerRegistryGrant {
+    constructor({ list, pull, run, write, } = {}) {
+        this.list = list;
+        this.pull = pull;
+        this.run = run;
+        this.write = write;
+    }
+    canList(repository) {
+        if (this.list !== undefined) {
+            return matchesGrantPattern(this.list, repository, false);
+        }
+        if (this.pull === undefined && this.run === undefined && this.write === undefined) {
+            return true;
+        }
+        return [this.pull, this.run, this.write]
+            .filter((patterns) => patterns !== undefined)
+            .some((patterns) => matchesGrantPattern(patterns, repository, false));
+    }
+    canPull(repository) {
+        return matchesGrantPattern(this.pull, repository, true);
+    }
+    canRun(repository) {
+        return matchesGrantPattern(this.run, repository, true);
+    }
+    canWrite(repository) {
+        return matchesGrantPattern(this.write, repository, true);
+    }
+    toJSON() {
+        const json = {};
+        if (this.list !== undefined) {
+            json["list"] = this.list;
+        }
+        if (this.pull !== undefined) {
+            json["pull"] = this.pull;
+        }
+        if (this.run !== undefined) {
+            json["run"] = this.run;
+        }
+        if (this.write !== undefined) {
+            json["write"] = this.write;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new ContainerRegistryGrant();
+        }
+        return new ContainerRegistryGrant({
+            list: asStringList(obj.list),
+            pull: asStringList(obj.pull),
+            run: asStringList(obj.run),
+            write: asStringList(obj.write),
+        });
+    }
+}
+exports.ContainerRegistryGrant = ContainerRegistryGrant;
 class ContainersGrant {
-    constructor({ logs, pull, run, useContainers } = {}) {
+    constructor({ logs, pull, run, registry, useContainers, } = {}) {
         this.logs = logs ?? true;
         this.pull = pull;
         this.run = run;
+        this.registry = registry;
         this.useContainers = useContainers ?? true;
     }
-    match(list, tag) {
-        if (!list) {
+    canPull(tag) {
+        return matchesGrantPattern(this.pull, tag, true);
+    }
+    canRun(tag) {
+        return matchesGrantPattern(this.run, tag, true);
+    }
+    canRegistryList(repository) {
+        if (this.registry === undefined) {
             return true;
         }
-        return list.some(t => tag === t || tag.startsWith(t.endsWith("*") ? t.slice(0, -1) : t));
+        return this.registry.canList(repository);
     }
-    canPull(tag) {
-        return this.match(this.pull, tag);
+    canRegistryPull(repository) {
+        if (this.registry === undefined) {
+            return true;
+        }
+        return this.registry.canPull(repository);
     }
-    canRun(tag) {
-        return this.match(this.run, tag);
+    canRegistryRun(repository) {
+        if (this.registry === undefined) {
+            return true;
+        }
+        return this.registry.canRun(repository);
+    }
+    canRegistryWrite(repository) {
+        if (this.registry === undefined) {
+            return true;
+        }
+        return this.registry.canWrite(repository);
+    }
+    toJSON() {
+        const json = {};
+        if (this.logs !== true) {
+            json["logs"] = this.logs;
+        }
+        if (this.pull !== undefined) {
+            json["pull"] = this.pull;
+        }
+        if (this.run !== undefined) {
+            json["run"] = this.run;
+        }
+        if (this.registry !== undefined) {
+            json["registry"] = this.registry.toJSON();
+        }
+        if (this.useContainers !== true) {
+            json["use_containers"] = this.useContainers;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new ContainersGrant();
+        }
+        return new ContainersGrant({
+            logs: obj.logs,
+            pull: asStringList(obj.pull),
+            run: asStringList(obj.run),
+            registry: obj.registry ? ContainerRegistryGrant.fromJSON(obj.registry) : undefined,
+            useContainers: obj.use_containers ?? obj.useContainers,
+        });
     }
 }
 exports.ContainersGrant = ContainersGrant;
@@ -170,71 +732,336 @@ class DeveloperGrant {
     constructor({ logs } = {}) {
         this.logs = logs ?? true;
     }
+    toJSON() {
+        const json = {};
+        if (this.logs !== true) {
+            json["logs"] = this.logs;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new DeveloperGrant();
+        }
+        return new DeveloperGrant({
+            logs: obj.logs,
+        });
+    }
 }
 exports.DeveloperGrant = DeveloperGrant;
 class AdminGrant {
+    constructor({ config } = {}) {
+        this.config = config ?? true;
+    }
+    toJSON() {
+        const json = {};
+        if (this.config !== true) {
+            json["config"] = this.config;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new AdminGrant();
+        }
+        return new AdminGrant({
+            config: obj.config,
+        });
+    }
 }
 exports.AdminGrant = AdminGrant;
+class OAuthEndpoint {
+    constructor({ endpoint, clientId }) {
+        this.endpoint = endpoint;
+        this.clientId = clientId;
+    }
+    toJSON() {
+        return {
+            endpoint: this.endpoint,
+            client_id: this.clientId,
+        };
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.endpoint !== "string") {
+            throw new Error("OAuthEndpoint requires an endpoint");
+        }
+        const clientId = obj.client_id ?? obj.clientId;
+        if (typeof clientId !== "string") {
+            throw new Error("OAuthEndpoint requires a client_id");
+        }
+        return new OAuthEndpoint({
+            endpoint: obj.endpoint,
+            clientId,
+        });
+    }
+}
+exports.OAuthEndpoint = OAuthEndpoint;
 class SecretsGrant {
-    canRequestOauthToken(authorizationEndpoint) {
-        if (!this.requestOauthToken) {
+    constructor({ requestOauthToken } = {}) {
+        this.requestOauthToken = requestOauthToken;
+    }
+    canRequestOauthToken({ connector, oauth, } = {}) {
+        void connector;
+        if (this.requestOauthToken === undefined) {
             return true;
         }
-        return this.requestOauthToken.some(t => t === authorizationEndpoint || ((t.endsWith("*") && authorizationEndpoint.startsWith(t.slice(0, -1)))));
+        const authorizationEndpoint = typeof oauth?.authorization_endpoint === "string"
+            ? oauth.authorization_endpoint.trim()
+            : "";
+        const clientId = typeof oauth?.client_id === "string"
+            ? oauth.client_id.trim()
+            : "";
+        if (authorizationEndpoint === "" || clientId === "") {
+            return false;
+        }
+        return this.requestOauthToken.some((endpointGrant) => ((endpointGrant.endpoint === authorizationEndpoint
+            || (endpointGrant.endpoint.endsWith("*")
+                && authorizationEndpoint.startsWith(endpointGrant.endpoint.slice(0, -1))))
+            && endpointGrant.clientId === clientId));
+    }
+    toJSON() {
+        const json = {};
+        if (this.requestOauthToken !== undefined) {
+            json["request_oauth_token"] = this.requestOauthToken.map((endpointGrant) => endpointGrant.toJSON());
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new SecretsGrant();
+        }
+        const requestOauthToken = obj.request_oauth_token ?? obj.requestOauthToken;
+        return new SecretsGrant({
+            requestOauthToken: Array.isArray(requestOauthToken)
+                ? requestOauthToken.map((endpointGrant) => OAuthEndpoint.fromJSON(endpointGrant))
+                : undefined,
+        });
     }
 }
 exports.SecretsGrant = SecretsGrant;
+class TunnelsGrant {
+    constructor({ ports } = {}) {
+        this.ports = ports;
+    }
+    toJSON() {
+        const json = {};
+        if (this.ports !== undefined) {
+            json["ports"] = this.ports;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new TunnelsGrant();
+        }
+        return new TunnelsGrant({
+            ports: asStringList(obj.ports),
+        });
+    }
+}
+exports.TunnelsGrant = TunnelsGrant;
+class ServicesGrant {
+    constructor({ list } = {}) {
+        this.list = list ?? true;
+    }
+    toJSON() {
+        const json = {};
+        if (this.list !== true) {
+            json["list"] = this.list;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new ServicesGrant();
+        }
+        return new ServicesGrant({
+            list: obj.list,
+        });
+    }
+}
+exports.ServicesGrant = ServicesGrant;
+class LLMGrant {
+    constructor({ models } = {}) {
+        this.models = models;
+    }
+    canUseProvider(provider) {
+        const normalizedProvider = provider.trim();
+        if (normalizedProvider === "") {
+            return false;
+        }
+        if (!this.models) {
+            return true;
+        }
+        const prefix = `${normalizedProvider}/`;
+        return this.models.some((pattern) => pattern.trim().startsWith(prefix));
+    }
+    canUseModel(provider, model) {
+        const normalizedProvider = provider.trim();
+        const normalizedModel = model.trim();
+        if (normalizedProvider === "" || normalizedModel === "") {
+            return false;
+        }
+        return matchesGrantPattern(this.models, `${normalizedProvider}/${normalizedModel}`, true);
+    }
+    toJSON() {
+        const json = {};
+        if (this.models !== undefined) {
+            json["models"] = this.models;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new LLMGrant();
+        }
+        return new LLMGrant({
+            models: asStringList(obj.models),
+        });
+    }
+}
+exports.LLMGrant = LLMGrant;
 class ApiScope {
-    constructor({ livekit, queues, messaging, database, sync, storage, containers, developer, agents, admin, secrets, } = {}) {
+    constructor({ livekit, queues, messaging, database, memory, sync, storage, containers, developer, agents, llm, admin, secrets, tunnels, services, } = {}) {
         this.livekit = livekit;
         this.queues = queues;
         this.messaging = messaging;
         this.database = database;
+        this.memory = memory;
         this.sync = sync;
         this.storage = storage;
         this.containers = containers;
         this.developer = developer;
         this.agents = agents;
+        this.llm = llm;
         this.admin = admin;
         this.secrets = secrets;
+        this.tunnels = tunnels;
+        this.services = services;
     }
-    static agentDefault() {
-        const s = new ApiScope();
-        s.livekit = new LivekitGrant();
-        s.queues = new QueuesGrant();
-        s.messaging = new MessagingGrant();
-        s.database = new DatabaseGrant();
-        s.sync = new SyncGrant();
-        s.storage = new StorageGrant();
-        s.containers = new ContainersGrant();
-        s.developer = new DeveloperGrant();
-        s.agents = new AgentsGrant();
-        return s;
+    static agentDefault({ tunnels = false } = {}) {
+        return new ApiScope({
+            livekit: new LivekitGrant(),
+            queues: new QueuesGrant(),
+            messaging: new MessagingGrant(),
+            database: new DatabaseGrant(),
+            memory: new MemoryGrant(),
+            sync: new SyncGrant(),
+            storage: new StorageGrant(),
+            containers: new ContainersGrant(),
+            developer: new DeveloperGrant(),
+            agents: new AgentsGrant(),
+            llm: new LLMGrant(),
+            secrets: new SecretsGrant(),
+            services: new ServicesGrant(),
+            tunnels: tunnels ? new TunnelsGrant() : undefined,
+        });
     }
     static userDefault() {
-        const s = new ApiScope();
-        s.livekit = new LivekitGrant();
-        s.queues = new QueuesGrant();
-        s.messaging = new MessagingGrant();
-        s.database = new DatabaseGrant();
-        s.sync = new SyncGrant();
-        s.storage = new StorageGrant();
-        s.containers = new ContainersGrant();
-        s.developer = new DeveloperGrant();
-        s.agents = new AgentsGrant();
-        s.secrets = new SecretsGrant();
-        return s;
+        return new ApiScope({
+            livekit: new LivekitGrant(),
+            queues: new QueuesGrant(),
+            messaging: new MessagingGrant(),
+            database: new DatabaseGrant(),
+            memory: new MemoryGrant(),
+            sync: new SyncGrant(),
+            storage: new StorageGrant(),
+            containers: new ContainersGrant(),
+            developer: new DeveloperGrant(),
+            agents: new AgentsGrant(),
+            secrets: new SecretsGrant(),
+            services: new ServicesGrant(),
+        });
     }
     static full() {
-        const s = ApiScope.agentDefault();
-        s.admin = new AdminGrant();
-        return s;
+        return new ApiScope({
+            livekit: new LivekitGrant(),
+            queues: new QueuesGrant(),
+            messaging: new MessagingGrant(),
+            database: new DatabaseGrant(),
+            memory: new MemoryGrant(),
+            sync: new SyncGrant(),
+            storage: new StorageGrant(),
+            containers: new ContainersGrant(),
+            developer: new DeveloperGrant(),
+            agents: new AgentsGrant(),
+            llm: new LLMGrant(),
+            admin: new AdminGrant(),
+            secrets: new SecretsGrant(),
+            tunnels: new TunnelsGrant(),
+            services: new ServicesGrant(),
+        });
     }
     toJSON() {
-        return { ...this };
+        const json = {};
+        if (this.livekit !== undefined) {
+            json["livekit"] = this.livekit.toJSON();
+        }
+        if (this.queues !== undefined) {
+            json["queues"] = this.queues.toJSON();
+        }
+        if (this.messaging !== undefined) {
+            json["messaging"] = this.messaging.toJSON();
+        }
+        if (this.database !== undefined) {
+            json["database"] = this.database.toJSON();
+        }
+        if (this.memory !== undefined) {
+            json["memory"] = this.memory.toJSON();
+        }
+        if (this.sync !== undefined) {
+            json["sync"] = this.sync.toJSON();
+        }
+        if (this.storage !== undefined) {
+            json["storage"] = this.storage.toJSON();
+        }
+        if (this.containers !== undefined) {
+            json["containers"] = this.containers.toJSON();
+        }
+        if (this.developer !== undefined) {
+            json["developer"] = this.developer.toJSON();
+        }
+        if (this.agents !== undefined) {
+            json["agents"] = this.agents.toJSON();
+        }
+        if (this.llm !== undefined) {
+            json["llm"] = this.llm.toJSON();
+        }
+        if (this.admin !== undefined) {
+            json["admin"] = this.admin.toJSON();
+        }
+        if (this.secrets !== undefined) {
+            json["secrets"] = this.secrets.toJSON();
+        }
+        if (this.tunnels !== undefined) {
+            json["tunnels"] = this.tunnels.toJSON();
+        }
+        if (this.services !== undefined) {
+            json["services"] = this.services.toJSON();
+        }
+        return json;
     }
     static fromJSON(obj) {
-        return Object.assign(new ApiScope(), obj);
+        if (!isRecord(obj)) {
+            return new ApiScope();
+        }
+        return new ApiScope({
+            livekit: obj.livekit ? LivekitGrant.fromJSON(obj.livekit) : undefined,
+            queues: obj.queues ? QueuesGrant.fromJSON(obj.queues) : undefined,
+            messaging: obj.messaging ? MessagingGrant.fromJSON(obj.messaging) : undefined,
+            database: obj.database ? DatabaseGrant.fromJSON(obj.database) : undefined,
+            memory: obj.memory ? MemoryGrant.fromJSON(obj.memory) : undefined,
+            sync: obj.sync ? SyncGrant.fromJSON(obj.sync) : undefined,
+            storage: obj.storage ? StorageGrant.fromJSON(obj.storage) : undefined,
+            containers: obj.containers ? ContainersGrant.fromJSON(obj.containers) : undefined,
+            developer: obj.developer ? DeveloperGrant.fromJSON(obj.developer) : undefined,
+            agents: obj.agents ? AgentsGrant.fromJSON(obj.agents) : undefined,
+            llm: obj.llm ? LLMGrant.fromJSON(obj.llm) : undefined,
+            admin: obj.admin ? AdminGrant.fromJSON(obj.admin) : undefined,
+            secrets: obj.secrets ? SecretsGrant.fromJSON(obj.secrets) : undefined,
+            tunnels: obj.tunnels ? TunnelsGrant.fromJSON(obj.tunnels) : undefined,
+            services: obj.services ? ServicesGrant.fromJSON(obj.services) : undefined,
+        });
     }
 }
 exports.ApiScope = ApiScope;
@@ -269,12 +1096,14 @@ class ParticipantGrant {
 }
 exports.ParticipantGrant = ParticipantGrant;
 function compareSemver(a, b) {
-    const pa = a.split(".").map(n => parseInt(n, 10));
-    const pb = b.split(".").map(n => parseInt(n, 10));
-    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
-        const x = pa[i] || 0, y = pb[i] || 0;
-        if (x !== y)
-            return x - y;
+    const pa = a.split(".").map((value) => parseInt(value, 10));
+    const pb = b.split(".").map((value) => parseInt(value, 10));
+    for (let index = 0; index < Math.max(pa.length, pb.length); index += 1) {
+        const left = pa[index] || 0;
+        const right = pb[index] || 0;
+        if (left !== right) {
+            return left - right;
+        }
     }
     return 0;
 }
@@ -283,14 +1112,14 @@ class ParticipantToken {
         this.name = name;
         this.projectId = projectId;
         this.apiKeyId = apiKeyId;
-        this.version = version;
+        this.version = version ?? version_1.__version__;
         this.extra = extra ?? {};
         this.grants = grants ?? [];
     }
     get role() {
-        for (const g of this.grants) {
-            if (g.name === "role" && g.scope !== "user") {
-                return String(g.scope);
+        for (const grant of this.grants) {
+            if (grant.name === "role" && grant.scope !== "user") {
+                return String(grant.scope);
             }
         }
         return "user";
@@ -312,8 +1141,10 @@ class ParticipantToken {
         return true;
     }
     addTunnelGrant(ports) {
-        const portsStr = ports.join(",");
-        this.grants.push(new ParticipantGrant({ name: "tunnel_ports", scope: portsStr }));
+        this.grants.push(new ParticipantGrant({
+            name: "tunnel_ports",
+            scope: ports.join(","),
+        }));
     }
     addRoleGrant(role) {
         this.grants.push(new ParticipantGrant({ name: "role", scope: role }));
@@ -322,132 +1153,113 @@ class ParticipantToken {
         this.grants.push(new ParticipantGrant({ name: "room", scope: roomName }));
     }
     addApiGrant(grant) {
+        for (const existingGrant of this.grants) {
+            if (existingGrant.name === "api") {
+                throw new Error("can only have a single api grant");
+            }
+        }
         this.grants.push(new ParticipantGrant({ name: "api", scope: grant }));
     }
     grantScope(name) {
-        return this.grants.find(g => g.name === name)?.scope;
+        return this.grants.find((grant) => grant.name === name)?.scope;
     }
     getApiGrant() {
-        const api = this.grantScope("api");
-        if (api && typeof api !== "string") {
-            return api;
-        }
-        if (this.version && compareSemver(this.version, "0.6.0") < 0 && !api) {
-            return new ApiScope({
-                livekit: new LivekitGrant(),
-                queues: new QueuesGrant(),
-                messaging: new MessagingGrant(),
-                database: new DatabaseGrant(),
-                sync: new SyncGrant(),
-                storage: new StorageGrant(),
-                agents: new AgentsGrant(),
-                developer: new DeveloperGrant(),
-            });
+        const apiGrant = this.grantScope("api");
+        if (apiGrant && typeof apiGrant !== "string") {
+            return apiGrant;
         }
-        return api;
+        return undefined;
     }
     toJson() {
-        const base = {
+        const json = {
+            ...(this.extra ?? {}),
             name: this.name,
-            grants: this.grants.map(g => g.toJson()),
+            grants: this.grants.map((grant) => grant.toJson()),
         };
-        if (this.projectId) {
-            base["sub"] = this.projectId;
+        if (this.projectId !== undefined) {
+            json["sub"] = this.projectId;
         }
-        if (this.apiKeyId) {
-            base["kid"] = this.apiKeyId;
+        if (this.apiKeyId !== undefined) {
+            json["kid"] = this.apiKeyId;
         }
-        if (this.version) {
-            base["version"] = this.version;
+        if (this.version !== undefined) {
+            json["version"] = this.version;
         }
-        return base;
+        return json;
     }
-    async toJwt({ token, expiration, apiKey } = {}) {
-        let apiGrant = null;
-        for (const g of this.grants) {
-            if (g.name === "api") {
-                apiGrant = g;
-                break;
-            }
+    async toJwt({ token, expiration, apiKey, } = {}) {
+        const apiGrant = this.grants.find((grant) => grant.name === "api");
+        if (!apiGrant && compareSemver(this.version, "0.3.5") > 0) {
+            console.warn("there is no ApiScope in the participant token, this participant will not be able to make calls to the the room API. Use addApiGrant to add an ApiScope to this token.");
         }
-        if (!apiGrant && this.version && compareSemver(this.version, "0.5.3") >= 0) {
-            console.error("ParticipantToken.toJwt: No API grant found, but version is >= 0.5.3. " +
-                "This may cause issues with older clients that expect an API grant.");
-        }
-        let resolvedSecret = token;
-        let resolvedKid = this.apiKeyId;
-        let resolvedSub = this.projectId;
-        const apiKeyValue = apiKey ?? getEnvValue("MESHAGENT_API_KEY");
-        if (apiKeyValue) {
-            const parsed = (0, api_keys_1.parseApiKey)(apiKeyValue);
-            resolvedSecret ?? (resolvedSecret = parsed.secret);
-            resolvedKid = parsed.id;
-            resolvedSub = parsed.projectId;
-        }
-        let usingDefaultSecret = false;
-        if (!resolvedSecret) {
-            const envSecret = getEnvValue("MESHAGENT_SECRET");
-            if (!envSecret) {
-                throw new Error("ParticipantToken.toJwt: No secret provided. Pass `token`, `apiKey`, or set MESHAGENT_SECRET / MESHAGENT_API_KEY.");
-            }
-            resolvedSecret = envSecret;
-            usingDefaultSecret = true;
-        }
-        const secretKey = new TextEncoder().encode(resolvedSecret);
         const payload = this.toJson();
-        if (resolvedSub) {
-            payload["sub"] = resolvedSub;
-        }
-        else {
-            delete payload["sub"];
+        const resolvedApiKey = apiKey ?? getEnvValue("MESHAGENT_API_KEY");
+        let resolvedSecret = token;
+        if (resolvedApiKey !== undefined) {
+            const parsed = (0, api_keys_1.parseApiKey)(resolvedApiKey);
+            resolvedSecret = parsed.secret;
+            payload["kid"] = parsed.id;
+            payload["sub"] = parsed.projectId;
         }
-        if (usingDefaultSecret) {
+        else if (resolvedSecret === undefined) {
             delete payload["kid"];
         }
-        else if (resolvedKid) {
-            payload["kid"] = resolvedKid;
+        if (resolvedSecret === undefined) {
+            resolvedSecret = getEnvValue("MESHAGENT_SECRET");
         }
-        else {
-            delete payload["kid"];
+        if (resolvedSecret === undefined) {
+            throw new Error("ParticipantToken.toJwt: No secret provided. Pass `token`, `apiKey`, or set MESHAGENT_SECRET / MESHAGENT_API_KEY.");
         }
-        if (expiration) {
+        if (expiration !== undefined) {
             payload.exp = Math.floor(expiration.getTime() / 1000);
         }
-        const jwt = new jose_1.SignJWT(payload)
-            .setProtectedHeader({ alg: "HS256", typ: "JWT" });
-        const jwtToken = await jwt.sign(secretKey);
-        return jwtToken;
+        const secretKey = new TextEncoder().encode(resolvedSecret);
+        return await new jose_1.SignJWT(payload)
+            .setProtectedHeader({ alg: "HS256", typ: "JWT" })
+            .sign(secretKey);
     }
     static fromJson(json) {
-        const { name, sub, grants, kid, version, ...rest } = json;
-        const extra = { ...rest };
-        const v = version ? version : "0.5.3";
+        const data = { ...json };
+        if (typeof data.name !== "string") {
+            throw new Error(`Participant token does not have a name ${JSON.stringify(json)}`);
+        }
+        const name = data.name;
+        delete data.name;
+        const grantsRaw = Array.isArray(data.grants) ? data.grants : [];
+        delete data.grants;
+        const projectId = typeof data.sub === "string" ? data.sub : undefined;
+        delete data.sub;
+        const apiKeyId = typeof data.kid === "string" ? data.kid : undefined;
+        delete data.kid;
+        const version = typeof data.version === "string" ? data.version : version_1.__version__;
+        delete data.version;
         return new ParticipantToken({
-            name: name,
-            projectId: sub,
-            apiKeyId: kid,
-            version: v,
-            grants: grants?.map((g) => ParticipantGrant.fromJson(g)),
-            extra,
+            name,
+            projectId,
+            apiKeyId,
+            grants: grantsRaw.map((grant) => ParticipantGrant.fromJson(grant)),
+            extra: data,
+            version,
         });
     }
     static async fromJwt(jwtStr, options = {}) {
-        const { token, verify = true } = options ?? {};
+        const { token, verify = true } = options;
         if (verify) {
-            const secretKey = new TextEncoder().encode(token);
+            const verificationToken = token ?? getEnvValue("MESHAGENT_SECRET");
+            if (verificationToken === undefined) {
+                throw new Error("Failed to verify JWT: no token provided");
+            }
+            const secretKey = new TextEncoder().encode(verificationToken);
             const { payload } = await (0, jose_1.jwtVerify)(jwtStr, secretKey, {
                 algorithms: ["HS256"],
             });
             return ParticipantToken.fromJson(payload);
         }
-        else {
-            try {
-                const payload = (0, jose_1.decodeJwt)(jwtStr);
-                return ParticipantToken.fromJson(payload);
-            }
-            catch (err) {
-                throw new Error("Failed to decode JWT");
-            }
+        try {
+            return ParticipantToken.fromJson((0, jose_1.decodeJwt)(jwtStr));
+        }
+        catch {
+            throw new Error("Failed to decode JWT");
         }
     }
 }