@meshagent/meshagent 0.36.3 → 0.37.1

package/dist/esm/participant-token.js

@@ -1,19 +1,87 @@
 import { decodeJwt, jwtVerify, SignJWT } from "jose";
 import { parseApiKey } from "./api_keys";
+import { __version__ } from "./version";
+function matchesGrantPattern(patterns, value, allowIfUnset) {
+    if (!patterns) {
+        return allowIfUnset;
+    }
+    return patterns.some((pattern) => value === pattern
+        || (pattern.endsWith("*")
+            && value.startsWith(pattern.slice(0, -1))));
+}
 function getEnvValue(name) {
     if (typeof process === "undefined") {
         return undefined;
     }
     return process.env?.[name];
 }
+function normalizeNamespace(namespace) {
+    return namespace ?? [];
+}
+function namespacesEqual(left, right) {
+    const normalizedLeft = normalizeNamespace(left);
+    const normalizedRight = normalizeNamespace(right);
+    if (normalizedLeft.length !== normalizedRight.length) {
+        return false;
+    }
+    return normalizedLeft.every((value, index) => value === normalizedRight[index]);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function asStringList(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string")
+        ? value
+        : undefined;
+}
 export class AgentsGrant {
-    constructor({ registerAgent, registerPublicToolkit, registerPrivateToolkit, call, useAgents, useTools, } = {}) {
+    constructor({ registerAgent, registerPublicToolkit, registerPrivateToolkit, call, useAgents, useTools, allowedToolkits, } = {}) {
         this.registerAgent = registerAgent ?? true;
         this.registerPublicToolkit = registerPublicToolkit ?? true;
         this.registerPrivateToolkit = registerPrivateToolkit ?? true;
         this.call = call ?? true;
         this.useAgents = useAgents ?? true;
         this.useTools = useTools ?? true;
+        this.allowedToolkits = allowedToolkits;
+    }
+    toJSON() {
+        const json = {};
+        if (this.registerAgent !== true) {
+            json["register_agent"] = this.registerAgent;
+        }
+        if (this.registerPublicToolkit !== true) {
+            json["register_public_toolkit"] = this.registerPublicToolkit;
+        }
+        if (this.registerPrivateToolkit !== true) {
+            json["register_private_toolkit"] = this.registerPrivateToolkit;
+        }
+        if (this.call !== true) {
+            json["call"] = this.call;
+        }
+        if (this.useAgents !== true) {
+            json["use_agents"] = this.useAgents;
+        }
+        if (this.useTools !== true) {
+            json["use_tools"] = this.useTools;
+        }
+        if (this.allowedToolkits !== undefined) {
+            json["allowed_toolkits"] = this.allowedToolkits;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new AgentsGrant();
+        }
+        return new AgentsGrant({
+            registerAgent: obj.register_agent ?? obj.registerAgent,
+            registerPublicToolkit: obj.register_public_toolkit ?? obj.registerPublicToolkit,
+            registerPrivateToolkit: obj.register_private_toolkit ?? obj.registerPrivateToolkit,
+            call: obj.call,
+            useAgents: obj.use_agents ?? obj.useAgents,
+            useTools: obj.use_tools ?? obj.useTools,
+            allowedToolkits: asStringList(obj.allowed_toolkits ?? obj.allowedToolkits),
+        });
     }
 }
 export class LivekitGrant {
@@ -23,61 +91,367 @@ export class LivekitGrant {
     canJoinBreakoutRoom(name) {
         return !this.breakoutRooms || this.breakoutRooms.includes(name);
     }
+    toJSON() {
+        const json = {};
+        if (this.breakoutRooms !== undefined) {
+            json["breakout_rooms"] = this.breakoutRooms;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new LivekitGrant();
+        }
+        return new LivekitGrant({
+            breakoutRooms: asStringList(obj.breakout_rooms ?? obj.breakoutRooms),
+        });
+    }
 }
 export class QueuesGrant {
-    constructor({ send, receive, list } = {}) {
-        this.list = true;
+    constructor({ send, receive, list, } = {}) {
         this.send = send;
         this.receive = receive;
         this.list = list ?? true;
     }
-    canSend(q) {
-        return !this.send || this.send.includes(q);
+    canSend(queue) {
+        return !this.send || this.send.includes(queue);
     }
-    canReceive(q) {
-        return !this.receive || this.receive.includes(q);
+    canReceive(queue) {
+        return !this.receive || this.receive.includes(queue);
+    }
+    toJSON() {
+        const json = {};
+        if (this.send !== undefined) {
+            json["send"] = this.send;
+        }
+        if (this.receive !== undefined) {
+            json["receive"] = this.receive;
+        }
+        if (this.list !== true) {
+            json["list"] = this.list;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new QueuesGrant();
+        }
+        return new QueuesGrant({
+            send: asStringList(obj.send),
+            receive: asStringList(obj.receive),
+            list: obj.list,
+        });
     }
 }
 export class MessagingGrant {
-    constructor({ broadcast, list, send } = {}) {
+    constructor({ broadcast, list, send, } = {}) {
         this.broadcast = broadcast ?? true;
         this.list = list ?? true;
         this.send = send ?? true;
     }
+    toJSON() {
+        const json = {};
+        if (this.broadcast !== true) {
+            json["broadcast"] = this.broadcast;
+        }
+        if (this.list !== true) {
+            json["list"] = this.list;
+        }
+        if (this.send !== true) {
+            json["send"] = this.send;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new MessagingGrant();
+        }
+        return new MessagingGrant({
+            broadcast: obj.broadcast,
+            list: obj.list,
+            send: obj.send,
+        });
+    }
 }
 export class TableGrant {
-    constructor({ name, write, read, alter }) {
-        this.write = false;
-        this.read = true;
-        this.alter = false;
+    constructor({ name, namespace, write, read, alter, }) {
         this.name = name;
+        this.namespace = namespace;
         this.write = write ?? false;
         this.read = read ?? true;
         this.alter = alter ?? false;
     }
+    toJSON() {
+        const json = {
+            name: this.name,
+        };
+        if (this.namespace !== undefined) {
+            json["namespace"] = this.namespace;
+        }
+        if (this.write !== false) {
+            json["write"] = this.write;
+        }
+        if (this.read !== true) {
+            json["read"] = this.read;
+        }
+        if (this.alter !== false) {
+            json["alter"] = this.alter;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.name !== "string") {
+            throw new Error("TableGrant requires a name");
+        }
+        return new TableGrant({
+            name: obj.name,
+            namespace: asStringList(obj.namespace),
+            write: obj.write,
+            read: obj.read,
+            alter: obj.alter,
+        });
+    }
 }
 export class DatabaseGrant {
-    constructor({ tables, listTables } = {}) {
-        this.listTables = true;
+    constructor({ tables, listTables, } = {}) {
         this.tables = tables;
         this.listTables = listTables ?? true;
     }
-    _match(table) {
-        if (!this.tables)
-            return undefined;
-        return this.tables.find(t => t.name === table);
+    matchingTables(table, namespace) {
+        if (this.tables === undefined) {
+            return [];
+        }
+        return this.tables.filter((tableGrant) => {
+            if (tableGrant.name !== table) {
+                return false;
+            }
+            if (tableGrant.namespace === undefined) {
+                return true;
+            }
+            return namespacesEqual(tableGrant.namespace, namespace);
+        });
     }
-    canWrite(table) {
-        const t = this._match(table);
-        return t ? t.write : this.tables === undefined;
+    canWrite(table, namespace) {
+        if (this.tables === undefined) {
+            return true;
+        }
+        const matches = this.matchingTables(table, namespace);
+        if (matches.length === 0) {
+            return false;
+        }
+        return matches.some((tableGrant) => tableGrant.write);
     }
-    canRead(table) {
-        const t = this._match(table);
-        return t ? t.read : this.tables === undefined;
+    canRead(table, namespace) {
+        if (this.tables === undefined) {
+            return true;
+        }
+        const matches = this.matchingTables(table, namespace);
+        if (matches.length === 0) {
+            return false;
+        }
+        return matches.some((tableGrant) => tableGrant.read);
     }
-    canAlter(table) {
-        const t = this._match(table);
-        return t ? t.alter : this.tables === undefined;
+    canAlter(table, namespace) {
+        if (this.tables === undefined) {
+            return true;
+        }
+        const matches = this.matchingTables(table, namespace);
+        if (matches.length === 0) {
+            return false;
+        }
+        return matches.some((tableGrant) => tableGrant.alter);
+    }
+    canAccess(table, namespace) {
+        return (this.canRead(table, namespace)
+            || this.canWrite(table, namespace)
+            || this.canAlter(table, namespace));
+    }
+    toJSON() {
+        const json = {};
+        if (this.tables !== undefined) {
+            json["tables"] = this.tables.map((tableGrant) => tableGrant.toJSON());
+        }
+        if (this.listTables !== true) {
+            json["list_tables"] = this.listTables;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new DatabaseGrant();
+        }
+        return new DatabaseGrant({
+            tables: Array.isArray(obj.tables)
+                ? obj.tables.map((tableGrant) => TableGrant.fromJSON(tableGrant))
+                : undefined,
+            listTables: obj.list_tables ?? obj.listTables,
+        });
+    }
+}
+export class MemoryPermissions {
+    constructor({ create, drop, inspect, query, upsert, ingest, recall, optimize, } = {}) {
+        this.create = create ?? true;
+        this.drop = drop ?? true;
+        this.inspect = inspect ?? true;
+        this.query = query ?? true;
+        this.upsert = upsert ?? true;
+        this.ingest = ingest ?? true;
+        this.recall = recall ?? true;
+        this.optimize = optimize ?? true;
+    }
+    toJSON() {
+        const json = {};
+        if (this.create !== true) {
+            json["create"] = this.create;
+        }
+        if (this.drop !== true) {
+            json["drop"] = this.drop;
+        }
+        if (this.inspect !== true) {
+            json["inspect"] = this.inspect;
+        }
+        if (this.query !== true) {
+            json["query"] = this.query;
+        }
+        if (this.upsert !== true) {
+            json["upsert"] = this.upsert;
+        }
+        if (this.ingest !== true) {
+            json["ingest"] = this.ingest;
+        }
+        if (this.recall !== true) {
+            json["recall"] = this.recall;
+        }
+        if (this.optimize !== true) {
+            json["optimize"] = this.optimize;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new MemoryPermissions();
+        }
+        return new MemoryPermissions({
+            create: obj.create,
+            drop: obj.drop,
+            inspect: obj.inspect,
+            query: obj.query,
+            upsert: obj.upsert,
+            ingest: obj.ingest,
+            recall: obj.recall,
+            optimize: obj.optimize,
+        });
+    }
+}
+export class MemoryEntryGrant {
+    constructor({ name, namespace, permissions, }) {
+        this.name = name;
+        this.namespace = namespace;
+        this.permissions = permissions ?? new MemoryPermissions();
+    }
+    toJSON() {
+        const json = {
+            name: this.name,
+        };
+        if (this.namespace !== undefined) {
+            json["namespace"] = this.namespace;
+        }
+        json["permissions"] = this.permissions.toJSON();
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.name !== "string") {
+            throw new Error("MemoryEntryGrant requires a name");
+        }
+        return new MemoryEntryGrant({
+            name: obj.name,
+            namespace: asStringList(obj.namespace),
+            permissions: MemoryPermissions.fromJSON(obj.permissions),
+        });
+    }
+}
+export class MemoryGrant {
+    constructor({ list, memories, } = {}) {
+        this.list = list ?? true;
+        this.memories = memories;
+    }
+    matchingMemories(name, namespace) {
+        if (this.memories === undefined) {
+            return [];
+        }
+        return this.memories.filter((memoryGrant) => {
+            if (memoryGrant.name !== name) {
+                return false;
+            }
+            if (memoryGrant.namespace === undefined) {
+                return true;
+            }
+            return namespacesEqual(memoryGrant.namespace, namespace);
+        });
+    }
+    can(name, namespace, permission) {
+        if (this.memories === undefined) {
+            return true;
+        }
+        const matches = this.matchingMemories(name, namespace);
+        if (matches.length === 0) {
+            return false;
+        }
+        return matches.some((memoryGrant) => memoryGrant.permissions[permission]);
+    }
+    canCreate(name, namespace) {
+        return this.can(name, namespace, "create");
+    }
+    canDrop(name, namespace) {
+        return this.can(name, namespace, "drop");
+    }
+    canInspect(name, namespace) {
+        return this.can(name, namespace, "inspect");
+    }
+    canQuery(name, namespace) {
+        return this.can(name, namespace, "query");
+    }
+    canUpsert(name, namespace) {
+        return this.can(name, namespace, "upsert");
+    }
+    canIngest(name, namespace) {
+        return this.can(name, namespace, "ingest");
+    }
+    canRecall(name, namespace) {
+        return this.can(name, namespace, "recall");
+    }
+    canOptimize(name, namespace) {
+        return this.can(name, namespace, "optimize");
+    }
+    canAccessExisting(name, namespace) {
+        return (this.canDrop(name, namespace)
+            || this.canInspect(name, namespace)
+            || this.canQuery(name, namespace)
+            || this.canUpsert(name, namespace)
+            || this.canIngest(name, namespace)
+            || this.canRecall(name, namespace)
+            || this.canOptimize(name, namespace));
+    }
+    toJSON() {
+        const json = {};
+        if (this.list !== true) {
+            json["list"] = this.list;
+        }
+        if (this.memories !== undefined) {
+            json["memories"] = this.memories.map((memoryGrant) => memoryGrant.toJSON());
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new MemoryGrant();
+        }
+        return new MemoryGrant({
+            list: obj.list,
+            memories: Array.isArray(obj.memories)
+                ? obj.memories.map((memoryGrant) => MemoryEntryGrant.fromJSON(memoryGrant))
+                : undefined,
+        });
     }
 }
 export class SyncPathGrant {
@@ -85,26 +459,67 @@ export class SyncPathGrant {
         this.path = path;
         this.readOnly = readOnly ?? false;
     }
+    toJSON() {
+        const json = {
+            path: this.path,
+        };
+        if (this.readOnly !== false) {
+            json["read_only"] = this.readOnly;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.path !== "string") {
+            throw new Error("SyncPathGrant requires a path");
+        }
+        return new SyncPathGrant({
+            path: obj.path,
+            readOnly: obj.read_only ?? obj.readOnly,
+        });
+    }
 }
 export class SyncGrant {
     constructor({ paths } = {}) {
         this.paths = paths;
     }
-    matches(p, path) {
-        return p.path === path || (p.path.endsWith("*") && path.startsWith(p.path.slice(0, -1)));
+    matches(pathGrant, path) {
+        return pathGrant.path === path
+            || (pathGrant.path.endsWith("*")
+                && path.startsWith(pathGrant.path.slice(0, -1)));
     }
     canRead(path) {
-        if (this.paths) {
-            return this.paths.some(p => this.matches(p, path));
+        if (this.paths === undefined) {
+            return true;
         }
-        return true;
+        return this.paths.some((pathGrant) => this.matches(pathGrant, path));
     }
     canWrite(path) {
-        if (this.paths) {
-            const p = this.paths.find(pp => this.matches(pp, path));
-            return p ? !p.readOnly : false;
+        if (this.paths === undefined) {
+            return true;
         }
-        return true;
+        for (const pathGrant of this.paths) {
+            if (this.matches(pathGrant, path)) {
+                return !pathGrant.readOnly;
+            }
+        }
+        return false;
+    }
+    toJSON() {
+        const json = {};
+        if (this.paths !== undefined) {
+            json["paths"] = this.paths.map((pathGrant) => pathGrant.toJSON());
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new SyncGrant();
+        }
+        return new SyncGrant({
+            paths: Array.isArray(obj.paths)
+                ? obj.paths.map((pathGrant) => SyncPathGrant.fromJSON(pathGrant))
+                : undefined,
+        });
     }
 }
 export class StoragePathGrant {
@@ -112,112 +527,516 @@ export class StoragePathGrant {
         this.path = path;
         this.readOnly = readOnly ?? false;
     }
+    toJSON() {
+        const json = {
+            path: this.path,
+        };
+        if (this.readOnly !== false) {
+            json["read_only"] = this.readOnly;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.path !== "string") {
+            throw new Error("StoragePathGrant requires a path");
+        }
+        return new StoragePathGrant({
+            path: obj.path,
+            readOnly: obj.read_only ?? obj.readOnly,
+        });
+    }
 }
 export class StorageGrant {
     constructor({ paths } = {}) {
         this.paths = paths;
     }
-    matches(p, path) {
-        return path.startsWith(p.path);
-    }
     canRead(path) {
-        if (!this.paths)
+        if (this.paths === undefined) {
             return true;
-        return this.paths.some(p => this.matches(p, path));
+        }
+        return this.paths.some((pathGrant) => path.startsWith(pathGrant.path));
     }
     canWrite(path) {
-        if (!this.paths)
+        if (this.paths === undefined) {
             return true;
-        const p = this.paths.find(pp => this.matches(pp, path));
-        return p ? !p.readOnly : false;
+        }
+        for (const pathGrant of this.paths) {
+            if (path.startsWith(pathGrant.path)) {
+                return !pathGrant.readOnly;
+            }
+        }
+        return false;
+    }
+    toJSON() {
+        const json = {};
+        if (this.paths !== undefined) {
+            json["paths"] = this.paths.map((pathGrant) => pathGrant.toJSON());
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new StorageGrant();
+        }
+        return new StorageGrant({
+            paths: Array.isArray(obj.paths)
+                ? obj.paths.map((pathGrant) => StoragePathGrant.fromJSON(pathGrant))
+                : undefined,
+        });
+    }
+}
+export class ContainerRegistryGrant {
+    constructor({ list, pull, run, write, } = {}) {
+        this.list = list;
+        this.pull = pull;
+        this.run = run;
+        this.write = write;
+    }
+    canList(repository) {
+        if (this.list !== undefined) {
+            return matchesGrantPattern(this.list, repository, false);
+        }
+        if (this.pull === undefined && this.run === undefined && this.write === undefined) {
+            return true;
+        }
+        return [this.pull, this.run, this.write]
+            .filter((patterns) => patterns !== undefined)
+            .some((patterns) => matchesGrantPattern(patterns, repository, false));
+    }
+    canPull(repository) {
+        return matchesGrantPattern(this.pull, repository, true);
+    }
+    canRun(repository) {
+        return matchesGrantPattern(this.run, repository, true);
+    }
+    canWrite(repository) {
+        return matchesGrantPattern(this.write, repository, true);
+    }
+    toJSON() {
+        const json = {};
+        if (this.list !== undefined) {
+            json["list"] = this.list;
+        }
+        if (this.pull !== undefined) {
+            json["pull"] = this.pull;
+        }
+        if (this.run !== undefined) {
+            json["run"] = this.run;
+        }
+        if (this.write !== undefined) {
+            json["write"] = this.write;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new ContainerRegistryGrant();
+        }
+        return new ContainerRegistryGrant({
+            list: asStringList(obj.list),
+            pull: asStringList(obj.pull),
+            run: asStringList(obj.run),
+            write: asStringList(obj.write),
+        });
     }
 }
 export class ContainersGrant {
-    constructor({ logs, pull, run, useContainers } = {}) {
+    constructor({ logs, pull, run, registry, useContainers, } = {}) {
         this.logs = logs ?? true;
         this.pull = pull;
         this.run = run;
+        this.registry = registry;
         this.useContainers = useContainers ?? true;
     }
-    match(list, tag) {
-        if (!list) {
+    canPull(tag) {
+        return matchesGrantPattern(this.pull, tag, true);
+    }
+    canRun(tag) {
+        return matchesGrantPattern(this.run, tag, true);
+    }
+    canRegistryList(repository) {
+        if (this.registry === undefined) {
             return true;
         }
-        return list.some(t => tag === t || tag.startsWith(t.endsWith("*") ? t.slice(0, -1) : t));
+        return this.registry.canList(repository);
     }
-    canPull(tag) {
-        return this.match(this.pull, tag);
+    canRegistryPull(repository) {
+        if (this.registry === undefined) {
+            return true;
+        }
+        return this.registry.canPull(repository);
     }
-    canRun(tag) {
-        return this.match(this.run, tag);
+    canRegistryRun(repository) {
+        if (this.registry === undefined) {
+            return true;
+        }
+        return this.registry.canRun(repository);
+    }
+    canRegistryWrite(repository) {
+        if (this.registry === undefined) {
+            return true;
+        }
+        return this.registry.canWrite(repository);
+    }
+    toJSON() {
+        const json = {};
+        if (this.logs !== true) {
+            json["logs"] = this.logs;
+        }
+        if (this.pull !== undefined) {
+            json["pull"] = this.pull;
+        }
+        if (this.run !== undefined) {
+            json["run"] = this.run;
+        }
+        if (this.registry !== undefined) {
+            json["registry"] = this.registry.toJSON();
+        }
+        if (this.useContainers !== true) {
+            json["use_containers"] = this.useContainers;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new ContainersGrant();
+        }
+        return new ContainersGrant({
+            logs: obj.logs,
+            pull: asStringList(obj.pull),
+            run: asStringList(obj.run),
+            registry: obj.registry ? ContainerRegistryGrant.fromJSON(obj.registry) : undefined,
+            useContainers: obj.use_containers ?? obj.useContainers,
+        });
     }
 }
 export class DeveloperGrant {
     constructor({ logs } = {}) {
         this.logs = logs ?? true;
     }
+    toJSON() {
+        const json = {};
+        if (this.logs !== true) {
+            json["logs"] = this.logs;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new DeveloperGrant();
+        }
+        return new DeveloperGrant({
+            logs: obj.logs,
+        });
+    }
 }
 export class AdminGrant {
+    constructor({ config } = {}) {
+        this.config = config ?? true;
+    }
+    toJSON() {
+        const json = {};
+        if (this.config !== true) {
+            json["config"] = this.config;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new AdminGrant();
+        }
+        return new AdminGrant({
+            config: obj.config,
+        });
+    }
+}
+export class OAuthEndpoint {
+    constructor({ endpoint, clientId }) {
+        this.endpoint = endpoint;
+        this.clientId = clientId;
+    }
+    toJSON() {
+        return {
+            endpoint: this.endpoint,
+            client_id: this.clientId,
+        };
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj) || typeof obj.endpoint !== "string") {
+            throw new Error("OAuthEndpoint requires an endpoint");
+        }
+        const clientId = obj.client_id ?? obj.clientId;
+        if (typeof clientId !== "string") {
+            throw new Error("OAuthEndpoint requires a client_id");
+        }
+        return new OAuthEndpoint({
+            endpoint: obj.endpoint,
+            clientId,
+        });
+    }
 }
 export class SecretsGrant {
-    canRequestOauthToken(authorizationEndpoint) {
-        if (!this.requestOauthToken) {
+    constructor({ requestOauthToken } = {}) {
+        this.requestOauthToken = requestOauthToken;
+    }
+    canRequestOauthToken({ connector, oauth, } = {}) {
+        void connector;
+        if (this.requestOauthToken === undefined) {
             return true;
         }
-        return this.requestOauthToken.some(t => t === authorizationEndpoint || ((t.endsWith("*") && authorizationEndpoint.startsWith(t.slice(0, -1)))));
+        const authorizationEndpoint = typeof oauth?.authorization_endpoint === "string"
+            ? oauth.authorization_endpoint.trim()
+            : "";
+        const clientId = typeof oauth?.client_id === "string"
+            ? oauth.client_id.trim()
+            : "";
+        if (authorizationEndpoint === "" || clientId === "") {
+            return false;
+        }
+        return this.requestOauthToken.some((endpointGrant) => ((endpointGrant.endpoint === authorizationEndpoint
+            || (endpointGrant.endpoint.endsWith("*")
+                && authorizationEndpoint.startsWith(endpointGrant.endpoint.slice(0, -1))))
+            && endpointGrant.clientId === clientId));
+    }
+    toJSON() {
+        const json = {};
+        if (this.requestOauthToken !== undefined) {
+            json["request_oauth_token"] = this.requestOauthToken.map((endpointGrant) => endpointGrant.toJSON());
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new SecretsGrant();
+        }
+        const requestOauthToken = obj.request_oauth_token ?? obj.requestOauthToken;
+        return new SecretsGrant({
+            requestOauthToken: Array.isArray(requestOauthToken)
+                ? requestOauthToken.map((endpointGrant) => OAuthEndpoint.fromJSON(endpointGrant))
+                : undefined,
+        });
+    }
+}
+export class TunnelsGrant {
+    constructor({ ports } = {}) {
+        this.ports = ports;
+    }
+    toJSON() {
+        const json = {};
+        if (this.ports !== undefined) {
+            json["ports"] = this.ports;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new TunnelsGrant();
+        }
+        return new TunnelsGrant({
+            ports: asStringList(obj.ports),
+        });
+    }
+}
+export class ServicesGrant {
+    constructor({ list } = {}) {
+        this.list = list ?? true;
+    }
+    toJSON() {
+        const json = {};
+        if (this.list !== true) {
+            json["list"] = this.list;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new ServicesGrant();
+        }
+        return new ServicesGrant({
+            list: obj.list,
+        });
+    }
+}
+export class LLMGrant {
+    constructor({ models } = {}) {
+        this.models = models;
+    }
+    canUseProvider(provider) {
+        const normalizedProvider = provider.trim();
+        if (normalizedProvider === "") {
+            return false;
+        }
+        if (!this.models) {
+            return true;
+        }
+        const prefix = `${normalizedProvider}/`;
+        return this.models.some((pattern) => pattern.trim().startsWith(prefix));
+    }
+    canUseModel(provider, model) {
+        const normalizedProvider = provider.trim();
+        const normalizedModel = model.trim();
+        if (normalizedProvider === "" || normalizedModel === "") {
+            return false;
+        }
+        return matchesGrantPattern(this.models, `${normalizedProvider}/${normalizedModel}`, true);
+    }
+    toJSON() {
+        const json = {};
+        if (this.models !== undefined) {
+            json["models"] = this.models;
+        }
+        return json;
+    }
+    static fromJSON(obj) {
+        if (!isRecord(obj)) {
+            return new LLMGrant();
+        }
+        return new LLMGrant({
+            models: asStringList(obj.models),
+        });
     }
 }
 export class ApiScope {
-    constructor({ livekit, queues, messaging, database, sync, storage, containers, developer, agents, admin, secrets, } = {}) {
+    constructor({ livekit, queues, messaging, database, memory, sync, storage, containers, developer, agents, llm, admin, secrets, tunnels, services, } = {}) {
         this.livekit = livekit;
         this.queues = queues;
         this.messaging = messaging;
         this.database = database;
+        this.memory = memory;
         this.sync = sync;
         this.storage = storage;
         this.containers = containers;
         this.developer = developer;
         this.agents = agents;
+        this.llm = llm;
         this.admin = admin;
         this.secrets = secrets;
+        this.tunnels = tunnels;
+        this.services = services;
     }
-    static agentDefault() {
-        const s = new ApiScope();
-        s.livekit = new LivekitGrant();
-        s.queues = new QueuesGrant();
-        s.messaging = new MessagingGrant();
-        s.database = new DatabaseGrant();
-        s.sync = new SyncGrant();
-        s.storage = new StorageGrant();
-        s.containers = new ContainersGrant();
-        s.developer = new DeveloperGrant();
-        s.agents = new AgentsGrant();
-        return s;
+    static agentDefault({ tunnels = false } = {}) {
+        return new ApiScope({
+            livekit: new LivekitGrant(),
+            queues: new QueuesGrant(),
+            messaging: new MessagingGrant(),
+            database: new DatabaseGrant(),
+            memory: new MemoryGrant(),
+            sync: new SyncGrant(),
+            storage: new StorageGrant(),
+            containers: new ContainersGrant(),
+            developer: new DeveloperGrant(),
+            agents: new AgentsGrant(),
+            llm: new LLMGrant(),
+            secrets: new SecretsGrant(),
+            services: new ServicesGrant(),
+            tunnels: tunnels ? new TunnelsGrant() : undefined,
+        });
     }
     static userDefault() {
-        const s = new ApiScope();
-        s.livekit = new LivekitGrant();
-        s.queues = new QueuesGrant();
-        s.messaging = new MessagingGrant();
-        s.database = new DatabaseGrant();
-        s.sync = new SyncGrant();
-        s.storage = new StorageGrant();
-        s.containers = new ContainersGrant();
-        s.developer = new DeveloperGrant();
-        s.agents = new AgentsGrant();
-        s.secrets = new SecretsGrant();
-        return s;
+        return new ApiScope({
+            livekit: new LivekitGrant(),
+            queues: new QueuesGrant(),
+            messaging: new MessagingGrant(),
+            database: new DatabaseGrant(),
+            memory: new MemoryGrant(),
+            sync: new SyncGrant(),
+            storage: new StorageGrant(),
+            containers: new ContainersGrant(),
+            developer: new DeveloperGrant(),
+            agents: new AgentsGrant(),
+            secrets: new SecretsGrant(),
+            services: new ServicesGrant(),
+        });
     }
     static full() {
-        const s = ApiScope.agentDefault();
-        s.admin = new AdminGrant();
-        return s;
+        return new ApiScope({
+            livekit: new LivekitGrant(),
+            queues: new QueuesGrant(),
+            messaging: new MessagingGrant(),
+            database: new DatabaseGrant(),
+            memory: new MemoryGrant(),
+            sync: new SyncGrant(),
+            storage: new StorageGrant(),
+            containers: new ContainersGrant(),
+            developer: new DeveloperGrant(),
+            agents: new AgentsGrant(),
+            llm: new LLMGrant(),
+            admin: new AdminGrant(),
+            secrets: new SecretsGrant(),
+            tunnels: new TunnelsGrant(),
+            services: new ServicesGrant(),
+        });
     }
     toJSON() {
-        return { ...this };
+        const json = {};
+        if (this.livekit !== undefined) {
+            json["livekit"] = this.livekit.toJSON();
+        }
+        if (this.queues !== undefined) {
+            json["queues"] = this.queues.toJSON();
+        }
+        if (this.messaging !== undefined) {
+            json["messaging"] = this.messaging.toJSON();
+        }
+        if (this.database !== undefined) {
+            json["database"] = this.database.toJSON();
+        }
+        if (this.memory !== undefined) {
+            json["memory"] = this.memory.toJSON();
+        }
+        if (this.sync !== undefined) {
+            json["sync"] = this.sync.toJSON();
+        }
+        if (this.storage !== undefined) {
+            json["storage"] = this.storage.toJSON();
+        }
+        if (this.containers !== undefined) {
+            json["containers"] = this.containers.toJSON();
+        }
+        if (this.developer !== undefined) {
+            json["developer"] = this.developer.toJSON();
+        }
+        if (this.agents !== undefined) {
+            json["agents"] = this.agents.toJSON();
+        }
+        if (this.llm !== undefined) {
+            json["llm"] = this.llm.toJSON();
+        }
+        if (this.admin !== undefined) {
+            json["admin"] = this.admin.toJSON();
+        }
+        if (this.secrets !== undefined) {
+            json["secrets"] = this.secrets.toJSON();
+        }
+        if (this.tunnels !== undefined) {
+            json["tunnels"] = this.tunnels.toJSON();
+        }
+        if (this.services !== undefined) {
+            json["services"] = this.services.toJSON();
+        }
+        return json;
     }
     static fromJSON(obj) {
-        return Object.assign(new ApiScope(), obj);
+        if (!isRecord(obj)) {
+            return new ApiScope();
+        }
+        return new ApiScope({
+            livekit: obj.livekit ? LivekitGrant.fromJSON(obj.livekit) : undefined,
+            queues: obj.queues ? QueuesGrant.fromJSON(obj.queues) : undefined,
+            messaging: obj.messaging ? MessagingGrant.fromJSON(obj.messaging) : undefined,
+            database: obj.database ? DatabaseGrant.fromJSON(obj.database) : undefined,
+            memory: obj.memory ? MemoryGrant.fromJSON(obj.memory) : undefined,
+            sync: obj.sync ? SyncGrant.fromJSON(obj.sync) : undefined,
+            storage: obj.storage ? StorageGrant.fromJSON(obj.storage) : undefined,
+            containers: obj.containers ? ContainersGrant.fromJSON(obj.containers) : undefined,
+            developer: obj.developer ? DeveloperGrant.fromJSON(obj.developer) : undefined,
+            agents: obj.agents ? AgentsGrant.fromJSON(obj.agents) : undefined,
+            llm: obj.llm ? LLMGrant.fromJSON(obj.llm) : undefined,
+            admin: obj.admin ? AdminGrant.fromJSON(obj.admin) : undefined,
+            secrets: obj.secrets ? SecretsGrant.fromJSON(obj.secrets) : undefined,
+            tunnels: obj.tunnels ? TunnelsGrant.fromJSON(obj.tunnels) : undefined,
+            services: obj.services ? ServicesGrant.fromJSON(obj.services) : undefined,
+        });
     }
 }
 export class ParticipantGrant {
@@ -250,12 +1069,14 @@ export class ParticipantGrant {
     }
 }
 function compareSemver(a, b) {
-    const pa = a.split(".").map(n => parseInt(n, 10));
-    const pb = b.split(".").map(n => parseInt(n, 10));
-    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
-        const x = pa[i] || 0, y = pb[i] || 0;
-        if (x !== y)
-            return x - y;
+    const pa = a.split(".").map((value) => parseInt(value, 10));
+    const pb = b.split(".").map((value) => parseInt(value, 10));
+    for (let index = 0; index < Math.max(pa.length, pb.length); index += 1) {
+        const left = pa[index] || 0;
+        const right = pb[index] || 0;
+        if (left !== right) {
+            return left - right;
+        }
     }
     return 0;
 }
@@ -264,14 +1085,14 @@ export class ParticipantToken {
         this.name = name;
         this.projectId = projectId;
         this.apiKeyId = apiKeyId;
-        this.version = version;
+        this.version = version ?? __version__;
         this.extra = extra ?? {};
         this.grants = grants ?? [];
     }
     get role() {
-        for (const g of this.grants) {
-            if (g.name === "role" && g.scope !== "user") {
-                return String(g.scope);
+        for (const grant of this.grants) {
+            if (grant.name === "role" && grant.scope !== "user") {
+                return String(grant.scope);
             }
         }
         return "user";
@@ -293,8 +1114,10 @@ export class ParticipantToken {
         return true;
     }
     addTunnelGrant(ports) {
-        const portsStr = ports.join(",");
-        this.grants.push(new ParticipantGrant({ name: "tunnel_ports", scope: portsStr }));
+        this.grants.push(new ParticipantGrant({
+            name: "tunnel_ports",
+            scope: ports.join(","),
+        }));
     }
     addRoleGrant(role) {
         this.grants.push(new ParticipantGrant({ name: "role", scope: role }));
@@ -303,132 +1126,113 @@ export class ParticipantToken {
         this.grants.push(new ParticipantGrant({ name: "room", scope: roomName }));
     }
     addApiGrant(grant) {
+        for (const existingGrant of this.grants) {
+            if (existingGrant.name === "api") {
+                throw new Error("can only have a single api grant");
+            }
+        }
         this.grants.push(new ParticipantGrant({ name: "api", scope: grant }));
     }
     grantScope(name) {
-        return this.grants.find(g => g.name === name)?.scope;
+        return this.grants.find((grant) => grant.name === name)?.scope;
     }
     getApiGrant() {
-        const api = this.grantScope("api");
-        if (api && typeof api !== "string") {
-            return api;
-        }
-        if (this.version && compareSemver(this.version, "0.6.0") < 0 && !api) {
-            return new ApiScope({
-                livekit: new LivekitGrant(),
-                queues: new QueuesGrant(),
-                messaging: new MessagingGrant(),
-                database: new DatabaseGrant(),
-                sync: new SyncGrant(),
-                storage: new StorageGrant(),
-                agents: new AgentsGrant(),
-                developer: new DeveloperGrant(),
-            });
+        const apiGrant = this.grantScope("api");
+        if (apiGrant && typeof apiGrant !== "string") {
+            return apiGrant;
         }
-        return api;
+        return undefined;
     }
     toJson() {
-        const base = {
+        const json = {
+            ...(this.extra ?? {}),
             name: this.name,
-            grants: this.grants.map(g => g.toJson()),
+            grants: this.grants.map((grant) => grant.toJson()),
         };
-        if (this.projectId) {
-            base["sub"] = this.projectId;
+        if (this.projectId !== undefined) {
+            json["sub"] = this.projectId;
         }
-        if (this.apiKeyId) {
-            base["kid"] = this.apiKeyId;
+        if (this.apiKeyId !== undefined) {
+            json["kid"] = this.apiKeyId;
         }
-        if (this.version) {
-            base["version"] = this.version;
+        if (this.version !== undefined) {
+            json["version"] = this.version;
         }
-        return base;
+        return json;
     }
-    async toJwt({ token, expiration, apiKey } = {}) {
-        let apiGrant = null;
-        for (const g of this.grants) {
-            if (g.name === "api") {
-                apiGrant = g;
-                break;
-            }
+    async toJwt({ token, expiration, apiKey, } = {}) {
+        const apiGrant = this.grants.find((grant) => grant.name === "api");
+        if (!apiGrant && compareSemver(this.version, "0.3.5") > 0) {
+            console.warn("there is no ApiScope in the participant token, this participant will not be able to make calls to the the room API. Use addApiGrant to add an ApiScope to this token.");
         }
-        if (!apiGrant && this.version && compareSemver(this.version, "0.5.3") >= 0) {
-            console.error("ParticipantToken.toJwt: No API grant found, but version is >= 0.5.3. " +
-                "This may cause issues with older clients that expect an API grant.");
-        }
-        let resolvedSecret = token;
-        let resolvedKid = this.apiKeyId;
-        let resolvedSub = this.projectId;
-        const apiKeyValue = apiKey ?? getEnvValue("MESHAGENT_API_KEY");
-        if (apiKeyValue) {
-            const parsed = parseApiKey(apiKeyValue);
-            resolvedSecret ?? (resolvedSecret = parsed.secret);
-            resolvedKid = parsed.id;
-            resolvedSub = parsed.projectId;
-        }
-        let usingDefaultSecret = false;
-        if (!resolvedSecret) {
-            const envSecret = getEnvValue("MESHAGENT_SECRET");
-            if (!envSecret) {
-                throw new Error("ParticipantToken.toJwt: No secret provided. Pass `token`, `apiKey`, or set MESHAGENT_SECRET / MESHAGENT_API_KEY.");
-            }
-            resolvedSecret = envSecret;
-            usingDefaultSecret = true;
-        }
-        const secretKey = new TextEncoder().encode(resolvedSecret);
         const payload = this.toJson();
-        if (resolvedSub) {
-            payload["sub"] = resolvedSub;
-        }
-        else {
-            delete payload["sub"];
+        const resolvedApiKey = apiKey ?? getEnvValue("MESHAGENT_API_KEY");
+        let resolvedSecret = token;
+        if (resolvedApiKey !== undefined) {
+            const parsed = parseApiKey(resolvedApiKey);
+            resolvedSecret = parsed.secret;
+            payload["kid"] = parsed.id;
+            payload["sub"] = parsed.projectId;
         }
-        if (usingDefaultSecret) {
+        else if (resolvedSecret === undefined) {
             delete payload["kid"];
         }
-        else if (resolvedKid) {
-            payload["kid"] = resolvedKid;
+        if (resolvedSecret === undefined) {
+            resolvedSecret = getEnvValue("MESHAGENT_SECRET");
         }
-        else {
-            delete payload["kid"];
+        if (resolvedSecret === undefined) {
+            throw new Error("ParticipantToken.toJwt: No secret provided. Pass `token`, `apiKey`, or set MESHAGENT_SECRET / MESHAGENT_API_KEY.");
         }
-        if (expiration) {
+        if (expiration !== undefined) {
             payload.exp = Math.floor(expiration.getTime() / 1000);
         }
-        const jwt = new SignJWT(payload)
-            .setProtectedHeader({ alg: "HS256", typ: "JWT" });
-        const jwtToken = await jwt.sign(secretKey);
-        return jwtToken;
+        const secretKey = new TextEncoder().encode(resolvedSecret);
+        return await new SignJWT(payload)
+            .setProtectedHeader({ alg: "HS256", typ: "JWT" })
+            .sign(secretKey);
     }
     static fromJson(json) {
-        const { name, sub, grants, kid, version, ...rest } = json;
-        const extra = { ...rest };
-        const v = version ? version : "0.5.3";
+        const data = { ...json };
+        if (typeof data.name !== "string") {
+            throw new Error(`Participant token does not have a name ${JSON.stringify(json)}`);
+        }
+        const name = data.name;
+        delete data.name;
+        const grantsRaw = Array.isArray(data.grants) ? data.grants : [];
+        delete data.grants;
+        const projectId = typeof data.sub === "string" ? data.sub : undefined;
+        delete data.sub;
+        const apiKeyId = typeof data.kid === "string" ? data.kid : undefined;
+        delete data.kid;
+        const version = typeof data.version === "string" ? data.version : __version__;
+        delete data.version;
         return new ParticipantToken({
-            name: name,
-            projectId: sub,
-            apiKeyId: kid,
-            version: v,
-            grants: grants?.map((g) => ParticipantGrant.fromJson(g)),
-            extra,
+            name,
+            projectId,
+            apiKeyId,
+            grants: grantsRaw.map((grant) => ParticipantGrant.fromJson(grant)),
+            extra: data,
+            version,
         });
     }
     static async fromJwt(jwtStr, options = {}) {
-        const { token, verify = true } = options ?? {};
+        const { token, verify = true } = options;
         if (verify) {
-            const secretKey = new TextEncoder().encode(token);
+            const verificationToken = token ?? getEnvValue("MESHAGENT_SECRET");
+            if (verificationToken === undefined) {
+                throw new Error("Failed to verify JWT: no token provided");
+            }
+            const secretKey = new TextEncoder().encode(verificationToken);
             const { payload } = await jwtVerify(jwtStr, secretKey, {
                 algorithms: ["HS256"],
             });
             return ParticipantToken.fromJson(payload);
         }
-        else {
-            try {
-                const payload = decodeJwt(jwtStr);
-                return ParticipantToken.fromJson(payload);
-            }
-            catch (err) {
-                throw new Error("Failed to decode JWT");
-            }
+        try {
+            return ParticipantToken.fromJson(decodeJwt(jwtStr));
+        }
+        catch {
+            throw new Error("Failed to decode JWT");
         }
     }
 }