@meshagent/meshagent 0.44.13 → 0.45.0

package/dist/node/meshagent-client.js

@@ -1,11 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Meshagent = exports.ManagedAgentGrant = exports.ServiceTemplateSpec = exports.RoomSession = void 0;
-exports.normalizeServiceSpec = normalizeServiceSpec;
+exports.Meshagent = exports.ServiceTemplateSpec = exports.RoomSession = void 0;
 const helpers_js_1 = require("./helpers.js");
 const requirement_js_1 = require("./requirement.js");
-const participant_token_js_1 = require("./participant-token.js");
-const utils_js_1 = require("./utils.js");
 class RoomSession {
     constructor({ id, roomId, roomName, createdAt, isActive, participants, kind = "room", agentId, agentName, }) {
         this.id = id;
@@ -32,226 +29,75 @@ class RoomSession {
     }
 }
 exports.RoomSession = RoomSession;
-function cloneJsonValue(value) {
-    if (Array.isArray(value)) {
-        return value.map((item) => cloneJsonValue(item));
-    }
-    if (value != null && typeof value === "object") {
-        const result = {};
-        for (const [key, item] of Object.entries(value)) {
-            result[key] = cloneJsonValue(item);
-        }
-        return result;
-    }
-    return value;
-}
-function formatTemplateString(value, values) {
-    return value.replace(/\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (token, key) => values[key] ?? token);
-}
-function formatJsonValue(value, values) {
+function applyTemplateValues(value, values) {
     if (typeof value === "string") {
-        return formatTemplateString(value, values);
+        return Object.entries(values).reduce((current, [key, replacement]) => current.split(`{${key}}`).join(replacement), value);
     }
     if (Array.isArray(value)) {
-        return value.map((item) => formatJsonValue(item, values));
+        return value.map((item) => applyTemplateValues(item, values));
     }
-    if (value != null && typeof value === "object") {
+    if (value !== null && typeof value === "object") {
         const result = {};
-        for (const [key, item] of Object.entries(value)) {
-            result[key] = formatJsonValue(item, values);
+        for (const [key, entry] of Object.entries(value)) {
+            result[key] = applyTemplateValues(entry, values);
         }
         return result;
     }
     return value;
 }
-function objectOrUndefined(value) {
-    return value != null && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : undefined;
-}
-function objectArray(value) {
-    return Array.isArray(value)
-        ? value.filter((item) => objectOrUndefined(item) !== undefined)
-        : undefined;
-}
-function stringValue(value) {
-    return typeof value === "string" ? value : undefined;
-}
-function booleanValue(value) {
-    return typeof value === "boolean" ? value : undefined;
-}
-function normalizeRoomMount(value) {
-    return {
-        path: stringValue(value.path) ?? "",
-        ...(stringValue(value.subpath) !== undefined ? { subpath: stringValue(value.subpath) } : {}),
-        ...(booleanValue(value.read_only) !== undefined ? { read_only: booleanValue(value.read_only) } : {}),
-    };
-}
-function normalizeProjectMount(value) {
-    return {
-        path: stringValue(value.path) ?? "",
-        ...(stringValue(value.subpath) !== undefined ? { subpath: stringValue(value.subpath) } : {}),
-        read_only: booleanValue(value.read_only) ?? true,
-    };
-}
-function normalizeImageMount(value) {
-    return {
-        path: stringValue(value.path) ?? "",
-        ...(stringValue(value.subpath) !== undefined ? { subpath: stringValue(value.subpath) } : {}),
-        read_only: booleanValue(value.read_only) ?? true,
-        image: stringValue(value.image) ?? "",
-    };
-}
-function normalizeFileMount(value) {
-    return {
-        path: stringValue(value.path) ?? "",
-        ...(stringValue(value.subpath) !== undefined ? { subpath: stringValue(value.subpath) } : {}),
-        read_only: booleanValue(value.read_only) ?? true,
-        text: stringValue(value.text) ?? "",
-    };
-}
-function normalizeEmptyDirMount(value) {
-    return {
-        path: stringValue(value.path) ?? "",
-        read_only: booleanValue(value.read_only) ?? false,
-    };
-}
-function normalizeConfigMount(value) {
-    return {
-        path: stringValue(value.path) ?? "/var/run/meshagent",
-    };
-}
-function normalizeContainerMountSpec(value) {
-    const source = objectOrUndefined(value) ?? {};
-    const room = objectArray(source.room)?.map(normalizeRoomMount);
-    const project = objectArray(source.project)?.map(normalizeProjectMount);
-    const images = objectArray(source.images)?.map(normalizeImageMount);
-    const files = objectArray(source.files)?.map(normalizeFileMount);
-    const emptyDirs = objectArray(source.empty_dirs)?.map(normalizeEmptyDirMount);
-    const configs = objectArray(source.configs)?.map(normalizeConfigMount);
-    return {
-        ...(room !== undefined ? { room } : {}),
-        ...(project !== undefined ? { project } : {}),
-        ...(images !== undefined ? { images } : {}),
-        ...(files !== undefined ? { files } : {}),
-        ...(emptyDirs !== undefined ? { empty_dirs: emptyDirs } : {}),
-        ...(configs !== undefined ? { configs } : {}),
-    };
-}
-function normalizeAgentSpec(agent, values) {
-    const formatted = formatJsonValue(agent, values);
-    const spec = cloneJsonValue(formatted);
-    if (spec.email != null && spec.email.public == null) {
-        spec.email = { ...spec.email, public: false };
-    }
-    if (spec.channels?.email) {
-        spec.channels = {
-            ...spec.channels,
-            email: spec.channels.email.map((channel) => ({
-                ...channel,
-                private: channel.private ?? false,
-            })),
-        };
-    }
-    if (spec.channels?.messaging) {
-        spec.channels = {
-            ...spec.channels,
-            messaging: spec.channels.messaging.map((channel) => ({
-                ...channel,
-                protocol: channel.protocol ?? "meshagent.agent-message.v1",
-            })),
-        };
-    }
-    return spec;
-}
 function normalizeServiceSpec(service) {
-    const normalized = cloneJsonValue(service);
-    if (normalized.container?.storage != null) {
-        normalized.container = {
-            ...normalized.container,
-            storage: normalizeContainerMountSpec(normalized.container.storage),
+    const storage = service.container?.storage;
+    const agents = service.agents?.map((agent) => ({
+        ...agent,
+        email: agent.email == null
+            ? agent.email
+            : {
+                ...agent.email,
+                public: agent.email.public ?? false,
+            },
+        channels: agent.channels == null
+            ? agent.channels
+            : {
+                ...agent.channels,
+                messaging: agent.channels.messaging?.map((channel) => ({
+                    ...channel,
+                    protocol: channel.protocol ?? "meshagent.agent-message.v1",
+                })),
+            },
+    }));
+    const container = service.container == null
+        ? service.container
+        : {
+            ...service.container,
+            storage: storage == null
+                ? storage
+                : {
+                    ...storage,
+                    configs: storage.configs?.map((config) => ({
+                        ...config,
+                        path: config.path ?? "/var/run/meshagent",
+                    })),
+                    files: storage.files?.map((file) => ({
+                        ...file,
+                        read_only: file.read_only ?? true,
+                    })),
+                },
         };
-    }
-    return normalized;
+    return { ...service, agents, container };
 }
 class ServiceTemplateSpec {
-    constructor({ version = "v1", kind = "ServiceTemplate", variables, metadata, ports = [], container, external, agents = [], }) {
-        this.version = version;
-        this.kind = kind;
-        this.variables = variables;
-        this.metadata = metadata;
-        this.ports = ports;
-        this.container = container;
-        this.external = external;
-        this.agents = agents;
+    constructor(template) {
+        this.template = template;
     }
     static fromJson(json) {
-        const metadata = objectOrUndefined(json.metadata);
-        if (metadata === undefined || typeof metadata.name !== "string") {
-            throw new requirement_js_1.RoomException("Invalid service template payload: missing metadata.name");
-        }
-        return new ServiceTemplateSpec({
-            version: stringValue(json.version) ?? "v1",
-            kind: stringValue(json.kind) ?? "ServiceTemplate",
-            variables: objectArray(json.variables),
-            metadata: cloneJsonValue(metadata),
-            ports: (objectArray(json.ports) ?? []),
-            container: objectOrUndefined(json.container),
-            external: objectOrUndefined(json.external),
-            agents: objectArray(json.agents) ?? [],
-        });
-    }
-    toJson() {
-        return {
-            version: this.version,
-            kind: this.kind,
-            ...(this.variables != null ? { variables: cloneJsonValue(this.variables) } : {}),
-            metadata: cloneJsonValue(this.metadata),
-            ...(this.ports.length > 0 ? { ports: cloneJsonValue(this.ports) } : {}),
-            ...(this.container != null ? { container: cloneJsonValue(this.container) } : {}),
-            ...(this.external != null ? { external: cloneJsonValue(this.external) } : {}),
-            ...(this.agents.length > 0 ? { agents: cloneJsonValue(this.agents) } : {}),
-        };
+        return new ServiceTemplateSpec(json);
     }
     toServiceSpec({ values = {} } = {}) {
-        const service = {
-            version: "v1",
+        const templated = applyTemplateValues(this.template, values);
+        return normalizeServiceSpec({
+            ...templated,
             kind: "Service",
-            metadata: cloneJsonValue(this.metadata),
-            agents: this.agents.map((agent) => normalizeAgentSpec(agent, values)),
-            ports: cloneJsonValue(this.ports),
-        };
-        if (this.container != null) {
-            const formattedContainer = formatJsonValue(this.container, values);
-            const image = stringValue(formattedContainer.image);
-            if (image === undefined || image.length === 0) {
-                throw new requirement_js_1.RoomException("ServiceTemplateSpec.image is required to build a ServiceSpec");
-            }
-            service.container = {
-                ...(booleanValue(formattedContainer.private) !== undefined ? { private: booleanValue(formattedContainer.private) } : {}),
-                ...(stringValue(formattedContainer.command) !== undefined ? { command: stringValue(formattedContainer.command) } : {}),
-                ...(stringValue(formattedContainer.working_dir) !== undefined ? { working_dir: stringValue(formattedContainer.working_dir) } : {}),
-                image,
-                ...(Array.isArray(formattedContainer.environment)
-                    ? { environment: formattedContainer.environment }
-                    : {}),
-                ...(objectOrUndefined(formattedContainer.storage) !== undefined
-                    ? { storage: normalizeContainerMountSpec(formattedContainer.storage) }
-                    : {}),
-                ...(booleanValue(formattedContainer.on_demand) !== undefined ? { on_demand: booleanValue(formattedContainer.on_demand) } : {}),
-                ...(booleanValue(formattedContainer.writable_root_fs) !== undefined
-                    ? { writable_root_fs: booleanValue(formattedContainer.writable_root_fs) }
-                    : {}),
-            };
-        }
-        if (this.external != null) {
-            const formattedExternal = formatJsonValue(this.external, values);
-            const url = stringValue(formattedExternal.url);
-            if (url !== undefined) {
-                service.external = { url };
-            }
-        }
-        return normalizeServiceSpec(service);
+        });
     }
 }
 exports.ServiceTemplateSpec = ServiceTemplateSpec;
@@ -277,28 +123,62 @@ function pruneUndefinedValues(value) {
     }
     return value;
 }
-function pruneNullishValues(value) {
-    if (Array.isArray(value)) {
-        return value
-            .map((item) => pruneNullishValues(item))
-            .filter((item) => item !== undefined);
+function validateServiceSpec(service) {
+    const container = service.container;
+    if (container == null) {
+        return;
     }
-    if (value === null || value === undefined) {
-        return undefined;
+    if (typeof container.run_as === "string") {
+        throw new Error("container.run_as must be an object with an email field");
     }
-    if (typeof value === "object") {
-        const result = {};
-        for (const [key, entryValue] of Object.entries(value)) {
-            const normalized = pruneNullishValues(entryValue);
-            if (normalized !== undefined) {
-                result[key] = normalized;
-            }
+    const environment = container.environment ?? [];
+    const hasSecretEnvironment = environment.some((entry) => entry.secret != null);
+    if (hasSecretEnvironment && container.run_as == null) {
+        throw new Error("container.run_as is required when using SecretValue");
+    }
+    for (const entry of environment) {
+        const secret = entry.secret;
+        if (secret == null) {
+            continue;
+        }
+        const unsupportedFields = Object.keys(secret).filter((key) => key !== "id");
+        if (unsupportedFields.length > 0) {
+            throw new Error(`unsupported SecretValue fields: ${unsupportedFields.join(", ")}`);
         }
-        return result;
     }
-    return value;
+    const pullSecret = container.pull_secret;
+    if (pullSecret != null) {
+        const unsupportedFields = Object.keys(pullSecret).filter((key) => key !== "id");
+        if (unsupportedFields.length > 0) {
+            throw new Error(`unsupported SecretValue fields: ${unsupportedFields.join(", ")}`);
+        }
+    }
+}
+const defaultServiceRunAsScopes = ["secrets:proxy"];
+function normalizeServiceRunAs(runAs) {
+    if (runAs == null) {
+        return runAs;
+    }
+    const email = runAs.email.trim().toLowerCase();
+    if (email.length === 0) {
+        throw new Error("container.run_as.email is required");
+    }
+    const scopes = runAs.scopes == null ? defaultServiceRunAsScopes : runAs.scopes;
+    const normalizedScopes = [];
+    for (const scope of scopes) {
+        const normalized = scope.trim();
+        if (normalized.length === 0 || normalizedScopes.includes(normalized)) {
+            continue;
+        }
+        normalizedScopes.push(normalized);
+    }
+    return {
+        email,
+        scopes: normalizedScopes.length === 0 ? [...defaultServiceRunAsScopes] : normalizedScopes,
+    };
 }
 function serializeServiceSpec(service) {
+    validateServiceSpec(service);
     const agents = service.agents?.map((agent) => ({
         ...agent,
         channels: agent.channels == null
@@ -311,8 +191,15 @@ function serializeServiceSpec(service) {
                 })),
             },
     }));
+    const container = service.container == null
+        ? service.container
+        : {
+            ...service.container,
+            run_as: normalizeServiceRunAs(service.container.run_as),
+        };
     return pruneUndefinedValues({
         ...service,
+        container,
         agents,
     });
 }
@@ -321,46 +208,6 @@ function serializeCreateServiceSpec(service) {
     delete payload.id;
     return payload;
 }
-class ManagedAgentGrant {
-    constructor({ admin = false } = {}) {
-        this.admin = admin;
-    }
-    static fromJson(json) {
-        return new ManagedAgentGrant({ admin: json["admin"] === true });
-    }
-    toJson() {
-        return { admin: this.admin };
-    }
-}
-exports.ManagedAgentGrant = ManagedAgentGrant;
-const globalScope = globalThis;
-function bytesToBase64(bytes) {
-    if (globalScope.Buffer) {
-        return globalScope.Buffer.from(bytes).toString("base64");
-    }
-    if (!globalScope.btoa) {
-        throw new Error("base64 encoding is not available in this runtime");
-    }
-    let binary = "";
-    for (const byte of bytes) {
-        binary += String.fromCharCode(byte);
-    }
-    return globalScope.btoa(binary);
-}
-function base64ToBytes(base64) {
-    if (globalScope.Buffer) {
-        return Uint8Array.from(globalScope.Buffer.from(base64, "base64"));
-    }
-    if (!globalScope.atob) {
-        throw new Error("base64 decoding is not available in this runtime");
-    }
-    const binary = globalScope.atob(base64);
-    const bytes = new Uint8Array(binary.length);
-    for (let index = 0; index < binary.length; index += 1) {
-        bytes[index] = binary.charCodeAt(index);
-    }
-    return bytes;
-}
 function toFetchBody(body) {
     if (body == null) {
         return undefined;
@@ -372,11 +219,16 @@ function toFetchBody(body) {
     copy.set(body);
     return copy.buffer;
 }
-function normalizeBinary(data) {
-    if (data instanceof Uint8Array) {
-        return data;
+function bytesToBase64(value) {
+    const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes).toString("base64");
     }
-    return new Uint8Array(data);
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
 }
 class Meshagent {
     constructor({ baseUrl, token } = {}) {
@@ -435,11 +287,10 @@ class Meshagent {
             catch {
                 message = "<unable to read body>";
             }
-            const errorMessage = `Failed to ${action}. Status code: ${response.status}, body: ${message}`;
             if (response.status === 403) {
-                throw new requirement_js_1.ForbiddenException(errorMessage);
+                throw new requirement_js_1.ForbiddenException(`Failed to ${action}. Status code: ${response.status}, body: ${message}`);
             }
-            throw new requirement_js_1.RoomException(errorMessage);
+            throw new requirement_js_1.RoomException(`Failed to ${action}. Status code: ${response.status}, body: ${message}`);
         }
         switch (responseType) {
             case "json":
@@ -456,22 +307,46 @@ class Meshagent {
                 return undefined;
         }
     }
-    parseRoomShare(data) {
-        if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid room share payload: expected object");
-        }
-        const { id, project_id: projectId, projectId: projectIdAlt, settings } = data;
-        if (typeof id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room share payload: missing id");
-        }
-        const finalProjectId = typeof projectIdAlt === "string" ? projectIdAlt : typeof projectId === "string" ? projectId : undefined;
-        if (!finalProjectId) {
-            throw new requirement_js_1.RoomException("Invalid room share payload: missing project id");
-        }
+    secretPayload(input) {
+        const payload = {};
+        if (input.projectId !== undefined)
+            payload.project_id = input.projectId;
+        if (input.name !== undefined)
+            payload.name = input.name;
+        if (input.type !== undefined)
+            payload.type = input.type;
+        if (input.httpOnly !== undefined)
+            payload.http_only = input.httpOnly;
+        if (input.metadata !== undefined)
+            payload.metadata = input.metadata;
+        if (input.annotations !== undefined)
+            payload.annotations = input.annotations;
+        return payload;
+    }
+    secretSearchPayload(input) {
+        const payload = {
+            page_size: input.pageSize ?? 100,
+        };
+        if (input.filter !== undefined)
+            payload.filter = input.filter;
+        if (input.name !== undefined)
+            payload.name = input.name;
+        if (input.type !== undefined)
+            payload.type = input.type;
+        if (input.httpOnly !== undefined)
+            payload.http_only = input.httpOnly;
+        if (input.metadata !== undefined)
+            payload.metadata = input.metadata;
+        if (input.annotations !== undefined)
+            payload.annotations = input.annotations;
+        if (input.continuationToken !== undefined)
+            payload.continuation_token = input.continuationToken;
+        return payload;
+    }
+    secretVersionPayload(input) {
         return {
-            id,
-            projectId: finalProjectId,
-            settings: (settings && typeof settings === "object") ? settings : {},
+            value_base64: bytesToBase64(input.value),
+            set_current: input.setCurrent ?? true,
         };
     }
     parseRoomSession(data) {
@@ -501,34 +376,33 @@ class Meshagent {
             createdAt: new Date(created),
             isActive: isActiveValue,
             participants: participants && typeof participants === "object" ? participants : undefined,
-            kind: typeof kind === "string" ? kind : "room",
+            kind: typeof kind === "string" ? kind : undefined,
             agentId: typeof agentId === "string" ? agentId : typeof agentIdRaw === "string" ? agentIdRaw : undefined,
             agentName: typeof agentName === "string" ? agentName : typeof agentNameRaw === "string" ? agentNameRaw : undefined,
         });
     }
-    parseManagedAgent(data) {
+    parseRoom(data) {
         if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid managed agent payload");
+            throw new requirement_js_1.RoomException("Invalid room payload");
         }
-        const { id, name, configuration } = data;
+        const { id, name, metadata, annotations } = data;
         if (typeof id !== "string" || typeof name !== "string") {
-            throw new requirement_js_1.RoomException("Invalid managed agent payload: missing id or name");
+            throw new requirement_js_1.RoomException("Invalid room payload: missing id or name");
         }
         return {
             id,
             name,
-            configuration: configuration && typeof configuration === "object" && !Array.isArray(configuration)
-                ? configuration
-                : {},
+            metadata: metadata && typeof metadata === "object" ? metadata : {},
+            annotations: annotations && typeof annotations === "object" ? annotations : {},
         };
     }
-    parseRoom(data) {
+    parseGroup(data) {
         if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid room payload");
+            throw new requirement_js_1.RoomException("Invalid group payload");
         }
         const { id, name, metadata, annotations } = data;
         if (typeof id !== "string" || typeof name !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room payload: missing id or name");
+            throw new requirement_js_1.RoomException("Invalid group payload: missing id or name");
         }
         return {
             id,
@@ -688,53 +562,170 @@ class Meshagent {
             createdAt: new Date(createdAtValue),
         };
     }
-    parseProjectRoomGrant(data) {
-        if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid room grant payload");
-        }
-        const roomData = data.room;
-        const room = this.parseRoom(roomData);
-        const userId = data.user_id ?? data.userId;
-        if (typeof userId !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room grant payload: missing user_id");
+    parseAccessResource(resource) {
+        if (!resource || typeof resource !== "object" || typeof resource.type !== "string" || typeof resource.id !== "string") {
+            throw new requirement_js_1.RoomException("Invalid access resource payload");
         }
-        const permissionsRaw = data.permissions;
-        const permissions = permissionsRaw && typeof permissionsRaw === "object" ? participant_token_js_1.ApiScope.fromJSON(permissionsRaw) : new participant_token_js_1.ApiScope();
-        return { room, userId, permissions };
+        return {
+            type: resource.type,
+            id: resource.id,
+            name: typeof resource.name === "string" ? resource.name : null,
+            metadata: resource.metadata && typeof resource.metadata === "object" ? resource.metadata : {},
+            annotations: resource.annotations && typeof resource.annotations === "object" ? resource.annotations : {},
+        };
     }
-    parseProjectRoomGrantCount(data) {
-        const roomData = (data && typeof data === "object") ? (data.room ?? { id: data.room_id, name: data.room_name, metadata: data.metadata ?? {} }) : undefined;
-        if (!roomData) {
-            throw new requirement_js_1.RoomException("Invalid room grant count payload: missing room");
-        }
-        const room = this.parseRoom(roomData);
-        const count = data.count;
-        if (typeof count !== "number") {
-            throw new requirement_js_1.RoomException("Invalid room grant count payload: missing count");
+    parseAccessSubject(subject) {
+        if (!subject || typeof subject !== "object" || typeof subject.type !== "string" || typeof subject.id !== "string") {
+            throw new requirement_js_1.RoomException("Invalid access subject payload");
         }
-        return { room, count };
+        return {
+            type: subject.type,
+            id: subject.id,
+            name: typeof subject.name === "string" ? subject.name : null,
+            firstName: typeof subject.first_name === "string" ? subject.first_name : null,
+            lastName: typeof subject.last_name === "string" ? subject.last_name : null,
+            email: typeof subject.email === "string" ? subject.email : null,
+            objectType: typeof subject.object_type === "string" ? subject.object_type : null,
+            relation: typeof subject.relation === "string" ? subject.relation : null,
+        };
+    }
+    serializeAccessSubject(subject) {
+        return {
+            type: subject.type,
+            id: subject.id,
+            ...(subject.name !== undefined ? { name: subject.name } : {}),
+            ...(subject.firstName !== undefined ? { first_name: subject.firstName } : {}),
+            ...(subject.lastName !== undefined ? { last_name: subject.lastName } : {}),
+            ...(subject.email !== undefined ? { email: subject.email } : {}),
+            ...(subject.objectType !== undefined ? { object_type: subject.objectType } : {}),
+            ...(subject.relation !== undefined ? { relation: subject.relation } : {}),
+        };
     }
-    parseProjectUserGrantCount(data) {
+    serializeAccessResource(resource) {
+        return {
+            type: resource.type,
+            id: resource.id,
+            ...(resource.name !== undefined ? { name: resource.name } : {}),
+            ...(resource.metadata !== undefined ? { metadata: resource.metadata } : {}),
+            ...(resource.annotations !== undefined ? { annotations: resource.annotations } : {}),
+        };
+    }
+    parseProjectMember(data) {
         if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid room grant user count payload");
-        }
-        const { user_id: userIdRaw, userId, count, first_name: firstNameRaw, firstName, last_name: lastNameRaw, lastName, email } = data;
-        const userIdValue = typeof userId === "string" ? userId : userIdRaw;
-        if (typeof userIdValue !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room grant user count payload: missing user_id");
-        }
-        if (typeof count !== "number") {
-            throw new requirement_js_1.RoomException("Invalid room grant user count payload: missing count");
+            throw new requirement_js_1.RoomException("Invalid project member payload");
+        }
+        const user = data.user && typeof data.user === "object" ? data.user : data;
+        const directRoles = Array.isArray(data.direct_roles)
+            ? data.direct_roles.filter((item) => item === "member" ||
+                item === "admin" ||
+                item === "developer" ||
+                item === "room_creator" ||
+                item === "agent_creator" ||
+                item === "mailbox_creator" ||
+                item === "route_creator" ||
+                item === "scheduled_task_creator" ||
+                item === "llm_proxy_user" ||
+                item === "usage_reporter" ||
+                item === "billing_manager" ||
+                item === "group_manager")
+            : [];
+        const id = typeof user.id === "string" ? user.id : "";
+        const email = typeof user.email === "string" ? user.email : "";
+        return {
+            id,
+            email,
+            firstName: typeof user.first_name === "string" ? user.first_name : null,
+            lastName: typeof user.last_name === "string" ? user.last_name : null,
+            directRoles,
+        };
+    }
+    parseGroupMember(data) {
+        if (!data || typeof data !== "object") {
+            throw new requirement_js_1.RoomException("Invalid group member payload");
         }
-        if (typeof email !== "string") {
-            throw new requirement_js_1.RoomException("Invalid room grant user count payload: missing email");
+        const directRoles = Array.isArray(data.direct_roles)
+            ? data.direct_roles.filter((item) => item === "member" || item === "manager")
+            : [];
+        return {
+            subject: this.parseAccessSubject(data.subject),
+            directRoles,
+        };
+    }
+    parseProjectRoomGrant(data) {
+        if (!data || typeof data !== "object") {
+            throw new requirement_js_1.RoomException("Invalid room grant payload");
         }
+        const parsedResource = this.parseAccessResource(data.resource);
+        const parsedSubject = this.parseAccessSubject(data.subject);
+        const parsedDirectRoles = Array.isArray(data.direct_roles)
+            ? data.direct_roles.filter((item) => item === "member" ||
+                item === "viewer" ||
+                item === "operator" ||
+                item === "developer" ||
+                item === "admin" ||
+                item === "room_creator" ||
+                item === "room_inventory" ||
+                item === "room_manager" ||
+                item === "session_inventory" ||
+                item === "agent_creator" ||
+                item === "agent_inventory" ||
+                item === "agent_manager" ||
+                item === "repository_creator" ||
+                item === "repository_inventory" ||
+                item === "repository_manager" ||
+                item === "feed_creator" ||
+                item === "feed_inventory" ||
+                item === "feed_manager" ||
+                item === "oauth_client_creator" ||
+                item === "oauth_client_inventory" ||
+                item === "oauth_client_manager" ||
+                item === "api_key_creator" ||
+                item === "api_key_inventory" ||
+                item === "api_key_manager" ||
+                item === "service_creator" ||
+                item === "service_inventory" ||
+                item === "service_manager" ||
+                item === "service_account_creator" ||
+                item === "service_account_inventory" ||
+                item === "service_account_manager" ||
+                item === "participant_token_creator" ||
+                item === "mailbox_creator" ||
+                item === "mailbox_inventory" ||
+                item === "mailbox_manager" ||
+                item === "route_creator" ||
+                item === "route_inventory" ||
+                item === "route_manager" ||
+                item === "scheduled_task_creator" ||
+                item === "scheduled_task_inventory" ||
+                item === "scheduled_task_manager" ||
+                item === "feed_subscription_creator" ||
+                item === "feed_subscription_inventory" ||
+                item === "feed_subscription_manager" ||
+                item === "llm_logger_creator" ||
+                item === "llm_logger_inventory" ||
+                item === "llm_logger_manager" ||
+                item === "llm_proxy_user" ||
+                item === "usage_reporter" ||
+                item === "billing_manager" ||
+                item === "group_manager" ||
+                item === "reader" ||
+                item === "subscriber" ||
+                item === "publisher" ||
+                item === "manager" ||
+                item === "list")
+            : [];
+        const room = {
+            id: parsedResource.id,
+            name: parsedResource.name ?? parsedResource.id,
+            metadata: parsedResource.metadata ?? {},
+            annotations: parsedResource.annotations ?? {},
+        };
         return {
-            userId: userIdValue,
-            count,
-            firstName: typeof firstName === "string" ? firstName : firstNameRaw,
-            lastName: typeof lastName === "string" ? lastName : lastNameRaw,
-            email,
+            resource: parsedResource,
+            subject: parsedSubject,
+            directRoles: parsedDirectRoles,
+            room,
+            userId: parsedSubject.id,
         };
     }
     parseBalance(data) {
@@ -783,196 +774,13 @@ class Meshagent {
             createdAt: new Date(createdValue),
         };
     }
-    parseSecret(data) {
-        if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid secret payload");
-        }
-        const type = data.type;
-        if (type === "docker") {
-            const server = data.server;
-            const username = data.username;
-            const password = data.password;
-            if (typeof server !== "string" || typeof username !== "string" || typeof password !== "string") {
-                throw new requirement_js_1.RoomException("Invalid docker secret payload");
-            }
-            return {
-                id: typeof data.id === "string" ? data.id : undefined,
-                name: data.name,
-                type: "docker",
-                server,
-                username,
-                password,
-                email: typeof data.email === "string" ? data.email : undefined,
-            };
-        }
-        if (type === "keys") {
-            const record = data.data;
-            if (!record || typeof record !== "object") {
-                throw new requirement_js_1.RoomException("Invalid keys secret payload");
-            }
-            return {
-                id: typeof data.id === "string" ? data.id : undefined,
-                name: data.name,
-                type: "keys",
-                data: record,
-            };
-        }
-        throw new requirement_js_1.RoomException(`Unknown secret type: ${type}`);
-    }
-    parseManagedSecretInfo(data) {
-        if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid managed secret payload");
-        }
-        const { id, type, name, delegated_to: delegatedToRaw, delegatedTo } = data;
-        if (typeof id !== "string" || typeof type !== "string" || typeof name !== "string") {
-            throw new requirement_js_1.RoomException("Invalid managed secret payload: missing id, type, or name");
-        }
-        const delegatedToValue = typeof delegatedTo === "string"
-            ? delegatedTo
-            : typeof delegatedToRaw === "string"
-                ? delegatedToRaw
-                : null;
-        return {
-            id,
-            type,
-            name,
-            delegatedTo: delegatedToValue,
-        };
-    }
-    parseManagedSecret(data) {
-        const secret = this.parseManagedSecretInfo(data);
-        const dataBase64 = data.data_base64 ?? data.dataBase64;
-        if (typeof dataBase64 !== "string") {
-            throw new requirement_js_1.RoomException("Invalid managed secret payload: missing data_base64");
-        }
-        return {
-            ...secret,
-            dataBase64,
-            data: base64ToBytes(dataBase64),
-        };
-    }
-    parseSecretPayload(secret, rawData) {
-        let payload;
-        try {
-            payload = JSON.parse(utils_js_1.decoder.decode(rawData));
-        }
-        catch {
-            throw new requirement_js_1.RoomException(`Invalid secret payload for ${secret.id}`);
-        }
-        if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-            throw new requirement_js_1.RoomException(`Invalid secret payload for ${secret.id}`);
-        }
-        if (secret.type === "docker") {
-            const { server, username, password, email } = payload;
-            if (typeof server !== "string" || typeof username !== "string" || typeof password !== "string") {
-                throw new requirement_js_1.RoomException(`Invalid secret payload for ${secret.id}`);
-            }
-            return {
-                id: secret.id,
-                name: secret.name,
-                type: "docker",
-                server,
-                username,
-                password,
-                email: typeof email === "string" ? email : "none@example.com",
-            };
-        }
-        const entries = Object.entries(payload);
-        if (entries.some(([, value]) => typeof value !== "string")) {
-            throw new requirement_js_1.RoomException(`Invalid secret payload for ${secret.id}`);
-        }
-        return {
-            id: secret.id,
-            name: secret.name,
-            type: "keys",
-            data: Object.fromEntries(entries),
-        };
-    }
-    toSecretPayload(secret) {
-        if (secret.type === "docker") {
-            return {
-                name: secret.name,
-                type: secret.type,
-                data: {
-                    server: secret.server,
-                    username: secret.username,
-                    password: secret.password,
-                    email: secret.email ?? "none@example.com",
-                },
-            };
-        }
-        return {
-            name: secret.name,
-            type: secret.type,
-            data: { ...secret.data },
-        };
-    }
-    parseConnectorRef(data) {
-        if (data == null) {
-            return null;
-        }
-        if (typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid connector payload");
-        }
-        const { openai_connector_id: openaiConnectorIdRaw, openaiConnectorId, server_url: serverUrlRaw, serverUrl, client_secret_id: clientSecretIdRaw, clientSecretId, } = data;
-        return {
-            openaiConnectorId: typeof openaiConnectorId === "string"
-                ? openaiConnectorId
-                : typeof openaiConnectorIdRaw === "string"
-                    ? openaiConnectorIdRaw
-                    : null,
-            serverUrl: typeof serverUrl === "string"
-                ? serverUrl
-                : typeof serverUrlRaw === "string"
-                    ? serverUrlRaw
-                    : null,
-            clientSecretId: typeof clientSecretId === "string"
-                ? clientSecretId
-                : typeof clientSecretIdRaw === "string"
-                    ? clientSecretIdRaw
-                    : null,
-        };
-    }
-    serializeConnectorRef(connector) {
-        if (connector == null) {
-            return null;
-        }
-        const payload = {};
-        if (connector.openaiConnectorId) {
-            payload.openai_connector_id = connector.openaiConnectorId;
-        }
-        if (connector.serverUrl) {
-            payload.server_url = connector.serverUrl;
-        }
-        if (connector.clientSecretId) {
-            payload.client_secret_id = connector.clientSecretId;
-        }
-        return payload;
-    }
-    parseExternalOAuthClientRegistration(data) {
-        if (!data || typeof data !== "object") {
-            throw new requirement_js_1.RoomException("Invalid external oauth registration payload");
-        }
-        const { id, delegated_to: delegatedToRaw, delegatedTo, connector, oauth, client_id: clientIdRaw, clientId, client_secret: clientSecretRaw, clientSecret, } = data;
-        const delegatedToValue = typeof delegatedTo === "string" ? delegatedTo : delegatedToRaw;
-        const clientIdValue = typeof clientId === "string" ? clientId : clientIdRaw;
-        const clientSecretValue = typeof clientSecret === "string" ? clientSecret : clientSecretRaw;
-        if (typeof id !== "string" || typeof delegatedToValue !== "string" || typeof clientIdValue !== "string") {
-            throw new requirement_js_1.RoomException("Invalid external oauth registration payload: missing fields");
-        }
-        return {
-            id,
-            delegatedTo: delegatedToValue,
-            connector: this.parseConnectorRef(connector),
-            oauth: oauth && typeof oauth === "object" ? oauth : null,
-            clientId: clientIdValue,
-            clientSecret: typeof clientSecretValue === "string" ? clientSecretValue : null,
-        };
-    }
     parseOAuthClient(data) {
         if (!data || typeof data !== "object") {
             throw new requirement_js_1.RoomException("Invalid OAuth client payload");
         }
+        if ("client" in data && data.client && typeof data.client === "object") {
+            data = data.client;
+        }
         const { client_id: clientIdRaw, clientId, client_secret: clientSecretRaw, clientSecret, grant_types: grantTypesRaw, grantTypes, response_types: responseTypesRaw, responseTypes, redirect_uris: redirectUrisRaw, redirectUris, scope, project_id: projectIdRaw, projectId, metadata } = data;
         const clientIdValue = typeof clientId === "string" ? clientId : clientIdRaw;
         const clientSecretValue = typeof clientSecret === "string" ? clientSecret : clientSecretRaw;
@@ -998,6 +806,7 @@ class Meshagent {
             scope,
             projectId: projectIdValue,
             metadata: metadata && typeof metadata === "object" ? metadata : {},
+            official: Boolean(data.official),
         };
     }
     parseRoomConnectionInfo(data) {
@@ -1038,45 +847,6 @@ class Meshagent {
             responseType: "arrayBuffer",
         });
     }
-    async getProjectRole(projectId) {
-        const payload = await this.request(`/accounts/projects/${projectId}/role`, {
-            action: "fetch project role",
-        });
-        const role = payload?.role;
-        if (role !== "member" && role !== "admin" && role !== "developer") {
-            throw new requirement_js_1.RoomException("Invalid role payload");
-        }
-        return role;
-    }
-    async createShare(projectId, settings) {
-        return await this.request(`/accounts/projects/${projectId}/shares`, {
-            method: "POST",
-            json: { settings: settings ?? {} },
-            action: "create share",
-        });
-    }
-    async deleteShare(projectId, shareId) {
-        await this.request(`/accounts/projects/${projectId}/shares/${shareId}`, {
-            method: "DELETE",
-            action: "delete share",
-            responseType: "void",
-        });
-    }
-    async updateShare(projectId, shareId, settings) {
-        await this.request(`/accounts/projects/${projectId}/shares/${shareId}`, {
-            method: "PUT",
-            json: { settings: settings ?? {} },
-            action: "update share",
-            responseType: "void",
-        });
-    }
-    async listShares(projectId) {
-        const data = await this.request(`/accounts/projects/${projectId}/shares`, {
-            action: "list shares",
-        });
-        const shares = Array.isArray(data?.shares) ? data.shares : [];
-        return shares.map((item) => this.parseRoomShare(item));
-    }
     async createProject(name, settings) {
         return await this.request(`/accounts/projects`, {
             method: "POST",
@@ -1085,39 +855,15 @@ class Meshagent {
         });
     }
     async addUserToProject(projectId, userId, options = {}) {
-        const { isAdmin, isDeveloper, canCreateRooms, inviteRedirectUrl } = options;
+        const { roles = ["member"], email, inviteRedirectUrl } = options;
         return await this.request(`/accounts/projects/${projectId}/users`, {
             method: "POST",
             json: {
                 project_id: projectId,
                 user_id: userId,
-                ...(isAdmin !== undefined ? { is_admin: isAdmin } : {}),
-                ...(isDeveloper !== undefined ? { is_developer: isDeveloper } : {}),
-                ...(canCreateRooms !== undefined
-                    ? { can_create_rooms: canCreateRooms }
-                    : {}),
-                ...(inviteRedirectUrl !== undefined
-                    ? { invite_redirect_url: inviteRedirectUrl }
-                    : {}),
-            },
-            action: "add user to project",
-        });
-    }
-    async addUserToProjectByEmail(projectId, email, options = {}) {
-        const { isAdmin, isDeveloper, canCreateRooms, inviteRedirectUrl } = options;
-        return await this.request(`/accounts/projects/${projectId}/users`, {
-            method: "POST",
-            json: {
-                project_id: projectId,
-                email,
-                ...(isAdmin !== undefined ? { is_admin: isAdmin } : {}),
-                ...(isDeveloper !== undefined ? { is_developer: isDeveloper } : {}),
-                ...(canCreateRooms !== undefined
-                    ? { can_create_rooms: canCreateRooms }
-                    : {}),
-                ...(inviteRedirectUrl !== undefined
-                    ? { invite_redirect_url: inviteRedirectUrl }
-                    : {}),
+                roles,
+                ...(email !== undefined ? { email } : {}),
+                ...(inviteRedirectUrl !== undefined ? { invite_redirect_url: inviteRedirectUrl } : {}),
             },
             action: "add user to project",
         });
@@ -1135,79 +881,281 @@ class Meshagent {
             action: "update project settings",
         });
     }
+    async updateUserInProject(projectId, userId, roles) {
+        return await this.request(`/accounts/projects/${projectId}/users/${userId}`, {
+            method: "PUT",
+            json: { roles },
+            action: "update project user",
+        });
+    }
     async getUsersInProjectPage(projectId, options = {}) {
-        const { count = 100, offset = 0, filter } = options;
+        const { pageSize = 100, continuationToken, filter, email } = options;
         const data = await this.request(`/accounts/projects/${projectId}/users`, {
-            query: { count, offset, filter },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter, email },
             action: "fetch project users",
         });
-        const users = Array.isArray(data?.users) ? data.users : [];
-        return { users, total: typeof data?.total === "number" ? data.total : users.length };
-    }
-    async getUsersInProject(projectId) {
-        const page = await this.getUsersInProjectPage(projectId);
-        return { users: page.users, total: page.total };
+        const users = Array.isArray(data?.users) ? data.users : [];
+        return { users: users.map((user) => this.parseProjectMember(user)), continuationToken: data?.continuation_token ?? null };
+    }
+    async getUsersInProject(projectId) {
+        const page = await this.getUsersInProjectPage(projectId);
+        return page.users;
+    }
+    async getUserProfile(userId) {
+        return await this.request(`/accounts/profiles/${userId}`, {
+            action: "fetch user profile",
+        });
+    }
+    async updateUserProfile(userId, firstName, lastName) {
+        return await this.request(`/accounts/profiles/${userId}`, {
+            method: "PUT",
+            json: { first_name: firstName, last_name: lastName },
+            action: "update user profile",
+        });
+    }
+    async listProjects() {
+        return await this.request(`/accounts/projects`, {
+            action: "list projects",
+        });
+    }
+    async getProject(projectId) {
+        return await this.request(`/accounts/projects/${projectId}`, {
+            action: "get project",
+        });
+    }
+    async getProjectByKey(projectKey) {
+        return await this.request(`/accounts/projects/by-key/${encodeURIComponent(projectKey)}`, {
+            action: "get project by key",
+        });
+    }
+    async listServiceAccounts(projectId, options = {}) {
+        const params = new URLSearchParams();
+        if (options.pageSize !== undefined)
+            params.set("page_size", String(options.pageSize));
+        if (options.continuationToken !== undefined)
+            params.set("continuation_token", options.continuationToken);
+        if (options.filter !== undefined)
+            params.set("filter", options.filter);
+        if (options.view !== undefined)
+            params.set("view", options.view);
+        const query = params.toString();
+        return await this.request(`/accounts/projects/${projectId}/service-accounts${query ? `?${query}` : ""}`, {
+            action: "list service accounts",
+        });
+    }
+    async createServiceAccount(projectId, name, options = {}) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts`, {
+            method: "POST",
+            json: { name, ...options },
+            action: "create service account",
+        });
+    }
+    async mintParticipantToken(projectId, options) {
+        const json = options.grants !== undefined
+            ? { name: options.name, grants: options.grants }
+            : {
+                name: options.name,
+                room_name: options.roomName,
+                role: options.role,
+                api: options.api,
+            };
+        const data = await this.request(`/accounts/projects/${projectId}/participant-tokens`, {
+            method: "POST",
+            json,
+            action: "mint participant token",
+        });
+        if (typeof data?.token !== "string" || data.token.trim() === "") {
+            throw new Error("Invalid participant token mint response");
+        }
+        return data.token;
+    }
+    async createApiKey(projectId, serviceAccountId, name, description) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/api-keys`, {
+            method: "POST",
+            json: { name, description },
+            action: "create api key",
+        });
+    }
+    async deleteApiKey(projectId, serviceAccountId, id) {
+        await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/api-keys/${id}`, {
+            method: "DELETE",
+            action: "delete api key",
+            responseType: "void",
+        });
+    }
+    async revokeApiKeysByMsid(projectId, serviceAccountId, msid) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/api-keys:revoke`, {
+            method: "POST",
+            json: { msid },
+            action: "revoke api keys",
+        });
+    }
+    async listApiKeys(projectId, serviceAccountId) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/api-keys`, {
+            action: "list api keys",
+        });
+    }
+    async createUserSecret(input) {
+        return await this.request(`/accounts/users/me/secrets`, {
+            method: "POST",
+            json: this.secretPayload(input),
+            action: "create user secret",
+        });
+    }
+    async listUserSecrets(options = {}) {
+        return await this.request(`/accounts/users/me/secrets`, {
+            query: {
+                page_size: options.pageSize ?? 100,
+                continuation_token: options.continuationToken,
+                filter: options.filter,
+            },
+            action: "list user secrets",
+        });
+    }
+    async searchUserSecrets(input = {}) {
+        return await this.request(`/accounts/users/me/secrets:search`, {
+            method: "POST",
+            json: this.secretSearchPayload(input),
+            action: "search user secrets",
+        });
+    }
+    async getUserSecret(secretId, options = {}) {
+        return await this.request(`/accounts/users/me/secrets/${secretId}`, {
+            query: {
+                include_value: options.includeValue ? "true" : undefined,
+            },
+            action: "get user secret",
+        });
+    }
+    async updateUserSecret(secretId, input) {
+        return await this.request(`/accounts/users/me/secrets/${secretId}`, {
+            method: "PATCH",
+            json: this.secretPayload(input),
+            action: "update user secret",
+        });
+    }
+    async deleteUserSecret(secretId) {
+        await this.request(`/accounts/users/me/secrets/${secretId}`, {
+            method: "DELETE",
+            action: "delete user secret",
+            responseType: "void",
+        });
+    }
+    async listUserSecretVersions(secretId) {
+        const page = await this.request(`/accounts/users/me/secrets/${secretId}/versions`, {
+            action: "list user secret versions",
+        });
+        return page.versions;
+    }
+    async createUserSecretVersion(secretId, input) {
+        return await this.request(`/accounts/users/me/secrets/${secretId}/versions`, {
+            method: "POST",
+            json: this.secretVersionPayload(input),
+            action: "create user secret version",
+        });
+    }
+    async listUserSecretProxyAccess(secretId, options = {}) {
+        return await this.request(`/accounts/users/me/secrets/${secretId}/access`, {
+            query: {
+                page_size: options.pageSize ?? 100,
+                continuation_token: options.continuationToken,
+            },
+            action: "list user secret proxy access",
+        });
+    }
+    async grantUserSecretProxyAccess(secretId, serviceAccountId) {
+        await this.request(`/accounts/users/me/secrets/${secretId}/access:grant-proxy`, {
+            method: "POST",
+            json: { subject: { type: "service_account", id: serviceAccountId } },
+            action: "grant user secret proxy access",
+            responseType: "void",
+        });
+    }
+    async revokeUserSecretProxyAccess(secretId, serviceAccountId) {
+        await this.request(`/accounts/users/me/secrets/${secretId}/access:revoke-proxy`, {
+            method: "POST",
+            json: { subject: { type: "service_account", id: serviceAccountId } },
+            action: "revoke user secret proxy access",
+            responseType: "void",
+        });
+    }
+    async createServiceAccountSecret(projectId, serviceAccountId, input) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets`, {
+            method: "POST",
+            json: this.secretPayload(input),
+            action: "create service account secret",
+        });
+    }
+    async listServiceAccountSecrets(projectId, serviceAccountId, options = {}) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets`, {
+            query: {
+                page_size: options.pageSize ?? 100,
+                continuation_token: options.continuationToken,
+                filter: options.filter,
+            },
+            action: "list service account secrets",
+        });
     }
-    async getUserProfile(userId) {
-        return await this.request(`/accounts/profiles/${userId}`, {
-            action: "fetch user profile",
+    async searchServiceAccountSecrets(projectId, serviceAccountId, input = {}) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets:search`, {
+            method: "POST",
+            json: this.secretSearchPayload(input),
+            action: "search service account secrets",
         });
     }
-    async updateUserProfile(userId, firstName, lastName) {
-        return await this.request(`/accounts/profiles/${userId}`, {
-            method: "PUT",
-            json: { first_name: firstName, last_name: lastName },
-            action: "update user profile",
+    async getServiceAccountSecret(projectId, serviceAccountId, secretId, options = {}) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}`, {
+            query: {
+                include_value: options.includeValue ? "true" : undefined,
+            },
+            action: "get service account secret",
         });
     }
-    async listProjects() {
-        return await this.request(`/accounts/projects`, {
-            action: "list projects",
+    async updateServiceAccountSecret(projectId, serviceAccountId, secretId, input) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}`, {
+            method: "PATCH",
+            json: this.secretPayload(input),
+            action: "update service account secret",
         });
     }
-    async getProject(projectId) {
-        return await this.request(`/accounts/projects/${projectId}`, {
-            action: "get project",
+    async deleteServiceAccountSecret(projectId, serviceAccountId, secretId) {
+        await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}`, {
+            method: "DELETE",
+            action: "delete service account secret",
+            responseType: "void",
         });
     }
-    async getProjectByKey(projectKey) {
-        return await this.request(`/accounts/projects/by-key/${encodeURIComponent(projectKey)}`, {
-            action: "get project by key",
+    async listServiceAccountSecretVersions(projectId, serviceAccountId, secretId) {
+        const page = await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}/versions`, {
+            action: "list service account secret versions",
         });
+        return page.versions;
     }
-    async createAgent(params) {
-        const { projectId, configuration, ifNotExists = false, permissions } = params;
-        const permissionsJson = permissions == null
-            ? undefined
-            : Object.fromEntries(Object.entries(permissions).map(([userId, grant]) => [userId, grant.toJson()]));
-        const data = await this.request(`/accounts/projects/${this.encodePathComponent(projectId)}/agents`, {
+    async createServiceAccountSecretVersion(projectId, serviceAccountId, secretId, input) {
+        return await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/secrets/${secretId}/versions`, {
             method: "POST",
-            json: {
-                configuration: pruneNullishValues(configuration),
-                if_not_exists: ifNotExists,
-                ...(permissionsJson !== undefined ? { permissions: permissionsJson } : {}),
-            },
-            action: "create agent",
+            json: this.secretVersionPayload(input),
+            action: "create service account secret version",
         });
-        return this.parseManagedAgent(data);
     }
-    async createApiKey(projectId, name, description) {
-        return await this.request(`/accounts/projects/${projectId}/api-keys`, {
-            method: "POST",
-            json: { name, description },
-            action: "create api key",
+    async listServiceAccountPullSecrets(projectId, serviceAccountId) {
+        const page = await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/pull-secrets`, {
+            action: "list service account pull secrets",
         });
+        return page.secrets;
     }
-    async deleteApiKey(projectId, id) {
-        await this.request(`/accounts/projects/${projectId}/api-keys/${id}`, {
-            method: "DELETE",
-            action: "delete api key",
+    async addServiceAccountPullSecret(projectId, serviceAccountId, secretId) {
+        await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/pull-secrets/${secretId}`, {
+            method: "PUT",
+            action: "add service account pull secret",
             responseType: "void",
         });
     }
-    async listApiKeys(projectId) {
-        return await this.request(`/accounts/projects/${projectId}/api-keys`, {
-            action: "list api keys",
+    async removeServiceAccountPullSecret(projectId, serviceAccountId, secretId) {
+        await this.request(`/accounts/projects/${projectId}/service-accounts/${serviceAccountId}/pull-secrets/${secretId}`, {
+            method: "DELETE",
+            action: "remove service account pull secret",
+            responseType: "void",
         });
     }
     async getPricing() {
@@ -1318,6 +1266,40 @@ class Meshagent {
         const sessions = Array.isArray(data?.sessions) ? data.sessions : [];
         return sessions.map((item) => this.parseRoomSession(item));
     }
+    async listRecentRoomSessions(projectId, roomName, options = {}) {
+        const params = new URLSearchParams();
+        if (options.limit !== undefined) {
+            params.set("limit", String(options.limit));
+        }
+        const query = params.size > 0 ? `?${params.toString()}` : "";
+        const data = await this.request(`/accounts/projects/${projectId}/rooms/${encodeURIComponent(roomName)}/sessions${query}`, { action: "list recent room sessions" });
+        const sessions = Array.isArray(data?.sessions) ? data.sessions : [];
+        return sessions.map((item) => this.parseRoomSession(item));
+    }
+    async listRecentSingleAgentSessions(projectId, agentName, options = {}) {
+        const params = new URLSearchParams();
+        if (options.limit !== undefined) {
+            params.set("limit", String(options.limit));
+        }
+        const query = params.size > 0 ? `?${params.toString()}` : "";
+        const data = await this.request(`/accounts/projects/${projectId}/agents/${encodeURIComponent(agentName)}/sessions${query}`, { action: "list recent agent sessions" });
+        const sessions = Array.isArray(data?.sessions) ? data.sessions : [];
+        return sessions.map((item) => this.parseRoomSession(item));
+    }
+    async createAgent(params) {
+        const body = {
+            configuration: params.configuration,
+            if_not_exists: params.ifNotExists ?? false,
+        };
+        if (params.permissions != null) {
+            body.permissions = params.permissions;
+        }
+        return await this.request(`/accounts/projects/${params.projectId}/agents`, {
+            method: "POST",
+            json: body,
+            action: "create agent",
+        });
+    }
     async listSessionEvents(projectId, sessionId) {
         const data = await this.request(`/accounts/projects/${projectId}/sessions/${sessionId}/events`, {
             action: "list session events",
@@ -1346,34 +1328,6 @@ class Meshagent {
         const metrics = data?.["metrics"];
         return Array.isArray(metrics) ? metrics : [];
     }
-    async createWebhook(projectId, params) {
-        const { name, url, events, description = "", action: webhookAction = "", payload = null } = params;
-        return await this.request(`/accounts/projects/${projectId}/webhooks`, {
-            method: "POST",
-            json: { name, description, url, events, action: webhookAction, payload },
-            action: "create webhook",
-        });
-    }
-    async updateWebhook(projectId, webhookId, params) {
-        const { name, url, events, description = "", action: webhookAction = null, payload = null } = params;
-        return await this.request(`/accounts/projects/${projectId}/webhooks/${webhookId}`, {
-            method: "PUT",
-            json: { name, description, url, events, action: webhookAction, payload },
-            action: "update webhook",
-        });
-    }
-    async listWebhooks(projectId) {
-        return await this.request(`/accounts/projects/${projectId}/webhooks`, {
-            action: "list webhooks",
-        });
-    }
-    async deleteWebhook(projectId, webhookId) {
-        await this.request(`/accounts/projects/${projectId}/webhooks/${webhookId}`, {
-            method: "DELETE",
-            action: "delete webhook",
-            responseType: "void",
-        });
-    }
     async createMailbox(params) {
         const { projectId, address, room, queue, isPublic } = params;
         await this.request(`/accounts/projects/${projectId}/mailboxes`, {
@@ -1406,18 +1360,24 @@ class Meshagent {
         return { address, room, roomId: room_id, queue };
     }
     async listMailboxesPage(projectId, options = {}) {
-        const { count = 100, offset = 0, filter } = options;
+        const { pageSize = 100, continuationToken, filter } = options;
         const data = await this.request(`/accounts/projects/${projectId}/mailboxes`, {
-            query: { count, offset, filter },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter },
             action: "list mailboxes",
         });
         const mailboxes = Array.isArray(data?.mailboxes) ? data.mailboxes : [];
         const parsed = mailboxes.map((item) => this.parseMailbox(item));
-        return { mailboxes: parsed, total: typeof data?.total === "number" ? data.total : parsed.length };
+        return { mailboxes: parsed, total: typeof data?.total === "number" ? data.total : parsed.length, continuationToken: data.continuation_token ?? null };
     }
     async listMailboxes(projectId, options = {}) {
-        const page = await this.listMailboxesPage(projectId, options);
-        return page.mailboxes;
+        const mailboxes = [];
+        let continuationToken;
+        do {
+            const page = await this.listMailboxesPage(projectId, { ...options, continuationToken });
+            mailboxes.push(...page.mailboxes);
+            continuationToken = page.continuationToken ?? undefined;
+        } while (continuationToken);
+        return mailboxes;
     }
     async deleteMailbox(projectId, address) {
         await this.request(`/accounts/projects/${projectId}/mailboxes/${address}`, {
@@ -1464,18 +1424,24 @@ class Meshagent {
         return this.parseFeed(data.feed);
     }
     async listFeedsPage(projectId, options = {}) {
-        const { count = 100, offset = 0, filter } = options;
+        const { pageSize = 100, continuationToken, filter, view } = options;
         const data = await this.request(`/accounts/projects/${projectId}/feeds`, {
-            query: { count, offset, filter },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter, view },
             action: "list feeds",
         });
         const feeds = Array.isArray(data?.feeds) ? data.feeds : [];
         const parsed = feeds.map((item) => this.parseFeed(item));
-        return { feeds: parsed, total: typeof data?.total === "number" ? data.total : parsed.length };
+        return { feeds: parsed, total: typeof data?.total === "number" ? data.total : parsed.length, continuationToken: data.continuation_token ?? null };
     }
     async listFeeds(projectId, options = {}) {
-        const page = await this.listFeedsPage(projectId, options);
-        return page.feeds;
+        const feeds = [];
+        let continuationToken;
+        do {
+            const page = await this.listFeedsPage(projectId, { ...options, continuationToken });
+            feeds.push(...page.feeds);
+            continuationToken = page.continuationToken ?? undefined;
+        } while (continuationToken);
+        return feeds;
     }
     async listRoomFeedsPage(projectId, roomName, options = {}) {
         const { count = 100, offset = 0, filter } = options;
@@ -1634,12 +1600,28 @@ class Meshagent {
         });
         return this.parseProjectRepository(data);
     }
-    async listRepositories(projectId) {
+    async listRepositoriesPage(projectId, options = {}) {
+        const { pageSize = 100, view, continuationToken } = options;
         const data = await this.request(`/accounts/projects/${projectId}/repositories`, {
+            query: { page_size: pageSize, view, continuation_token: continuationToken },
             action: "list repositories",
         });
         const repositories = Array.isArray(data?.repositories) ? data.repositories : [];
-        return repositories.map((item) => this.parseProjectRepository(item));
+        return {
+            repositories: repositories.map((item) => this.parseProjectRepository(item)),
+            total: Number(data.total ?? repositories.length),
+            continuationToken: data.continuation_token ?? null,
+        };
+    }
+    async listRepositories(projectId, options = {}) {
+        const repositories = [];
+        let continuationToken;
+        do {
+            const page = await this.listRepositoriesPage(projectId, { view: options.view, continuationToken });
+            repositories.push(...page.repositories);
+            continuationToken = page.continuationToken ?? undefined;
+        } while (continuationToken);
+        return repositories;
     }
     async deleteRepository(projectId, repositoryId) {
         await this.request(`/accounts/projects/${projectId}/repositories/${repositoryId}`, {
@@ -1729,279 +1711,14 @@ class Meshagent {
             responseType: "void",
         });
     }
-    async createProjectSecret(params) {
-        const { projectId, name, type, data } = params;
-        const payload = await this.request(`/accounts/projects/${projectId}/secrets`, {
-            method: "POST",
-            json: {
-                name,
-                type,
-                data_base64: bytesToBase64(normalizeBinary(data)),
-            },
-            action: "create project secret",
-        });
-        if (!payload || typeof payload !== "object" || typeof payload.id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid create project secret response payload");
-        }
-        return payload.id;
-    }
-    async updateProjectSecret(params) {
-        const { projectId, secretId, name, type, data } = params;
-        await this.request(`/accounts/projects/${projectId}/secrets/${secretId}`, {
-            method: "PUT",
-            json: {
-                name,
-                type,
-                data_base64: bytesToBase64(normalizeBinary(data)),
-            },
-            action: "update project secret",
-            responseType: "void",
-        });
-    }
-    async getProjectSecret(projectId, secretId) {
-        const data = await this.request(`/accounts/projects/${projectId}/secrets/${secretId}`, {
-            action: "fetch project secret",
-        });
-        return this.parseManagedSecret(data);
-    }
-    async listProjectSecrets(projectId) {
-        const data = await this.request(`/accounts/projects/${projectId}/secrets`, {
-            action: "list project secrets",
-        });
-        const secrets = Array.isArray(data?.secrets) ? data.secrets : [];
-        return secrets.map((item) => this.parseManagedSecretInfo(item));
-    }
-    async deleteProjectSecret(projectId, secretId) {
-        await this.request(`/accounts/projects/${projectId}/secrets/${secretId}`, {
-            method: "DELETE",
-            action: "delete project secret",
-            responseType: "void",
-        });
-    }
-    async createRoomSecret(params) {
-        const { projectId, roomName, data, secretId, name, type, delegatedTo, forIdentity } = params;
-        const payload = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets`, {
-            method: "POST",
-            json: {
-                data_base64: bytesToBase64(normalizeBinary(data)),
-                secret_id: secretId,
-                name,
-                type,
-                delegated_to: delegatedTo,
-                for_identity: forIdentity,
-            },
-            action: "create room secret",
-        });
-        if (!payload || typeof payload !== "object" || typeof payload.id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid create room secret response payload");
-        }
-        return payload.id;
-    }
-    async updateRoomSecret(params) {
-        const { projectId, roomName, secretId, data, name, type, delegatedTo, forIdentity } = params;
-        await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets/${secretId}`, {
-            method: "PUT",
-            json: {
-                data_base64: bytesToBase64(normalizeBinary(data)),
-                name,
-                type,
-                delegated_to: delegatedTo,
-                for_identity: forIdentity,
-            },
-            action: "update room secret",
-            responseType: "void",
-        });
-    }
-    async getRoomSecret(params) {
-        const { projectId, roomName, secretId, delegatedTo, forIdentity } = params;
-        const data = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets/${secretId}`, {
-            query: {
-                delegated_to: delegatedTo,
-                for_identity: forIdentity,
-            },
-            action: "fetch room secret",
-        });
-        return this.parseManagedSecret(data);
-    }
-    async listRoomSecrets(params) {
-        const { projectId, roomName, forIdentity } = params;
-        const data = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets`, {
-            query: {
-                for_identity: forIdentity,
-            },
-            action: "list room secrets",
-        });
-        const secrets = Array.isArray(data?.secrets) ? data.secrets : [];
-        return secrets.map((item) => this.parseManagedSecretInfo(item));
-    }
-    async deleteRoomSecret(params) {
-        const { projectId, roomName, secretId, delegatedTo, forIdentity } = params;
-        await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/secrets/${secretId}`, {
-            method: "DELETE",
-            query: {
-                delegated_to: delegatedTo,
-                for_identity: forIdentity,
-            },
-            action: "delete room secret",
-            responseType: "void",
-        });
-    }
-    async createSecret(projectId, secret) {
-        await this.createProjectSecret({
-            projectId,
-            name: secret.name,
-            type: secret.type,
-            data: utils_js_1.encoder.encode(JSON.stringify(this.toSecretPayload(secret).data)),
-        });
-    }
-    async updateSecret(projectId, secret) {
-        if (!secret.id) {
-            throw new requirement_js_1.RoomException("Secret id is required to update a secret");
-        }
-        await this.updateProjectSecret({
-            projectId,
-            secretId: secret.id,
-            name: secret.name,
-            type: secret.type,
-            data: utils_js_1.encoder.encode(JSON.stringify(this.toSecretPayload(secret).data)),
-        });
-    }
-    async deleteSecret(projectId, secretId) {
-        await this.deleteProjectSecret(projectId, secretId);
-    }
-    async listSecrets(projectId) {
-        const secretInfos = await this.listProjectSecrets(projectId);
-        const secrets = await Promise.all(secretInfos.map(async (secretInfo) => {
-            const secret = await this.getProjectSecret(projectId, secretInfo.id);
-            return this.parseSecretPayload(secret, secret.data);
-        }));
-        return secrets;
-    }
-    async createProjectExternalOAuthRegistration(params) {
-        const { projectId, oauth, clientId, clientSecret, delegatedTo, connector } = params;
-        const payload = await this.request(`/accounts/projects/${projectId}/external-oauth`, {
-            method: "POST",
-            json: {
-                oauth,
-                client_id: clientId,
-                client_secret: clientSecret,
-                delegated_to: delegatedTo,
-                connector: this.serializeConnectorRef(connector),
-            },
-            action: "create project external oauth registration",
-        });
-        if (!payload || typeof payload !== "object" || typeof payload.id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid create project external oauth registration response payload");
-        }
-        return payload.id;
-    }
-    async updateProjectExternalOAuthRegistration(params) {
-        const { projectId, registrationId, oauth, clientId, clientSecret, delegatedTo, connector } = params;
-        await this.request(`/accounts/projects/${projectId}/external-oauth/${registrationId}`, {
-            method: "PUT",
-            json: {
-                oauth,
-                client_id: clientId,
-                client_secret: clientSecret,
-                delegated_to: delegatedTo,
-                connector: this.serializeConnectorRef(connector),
-            },
-            action: "update project external oauth registration",
-            responseType: "void",
-        });
-    }
-    async listProjectExternalOAuthRegistrations(params) {
-        const { projectId, delegatedTo } = params;
-        const data = await this.request(`/accounts/projects/${projectId}/external-oauth`, {
-            query: {
-                delegated_to: delegatedTo,
-            },
-            action: "list project external oauth registrations",
-        });
-        const registrations = Array.isArray(data?.registrations) ? data.registrations : [];
-        return registrations.map((item) => this.parseExternalOAuthClientRegistration(item));
-    }
-    async deleteProjectExternalOAuthRegistration(params) {
-        const { projectId, registrationId, delegatedTo } = params;
-        await this.request(`/accounts/projects/${projectId}/external-oauth/${registrationId}`, {
-            method: "DELETE",
-            query: {
-                delegated_to: delegatedTo,
-            },
-            action: "delete project external oauth registration",
-            responseType: "void",
-        });
-    }
-    async createRoomExternalOAuthRegistration(params) {
-        const { projectId, roomName, oauth, clientId, clientSecret, delegatedTo, connector } = params;
-        const payload = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/external-oauth`, {
-            method: "POST",
-            json: {
-                oauth,
-                client_id: clientId,
-                client_secret: clientSecret,
-                delegated_to: delegatedTo,
-                connector: this.serializeConnectorRef(connector),
-            },
-            action: "create room external oauth registration",
-        });
-        if (!payload || typeof payload !== "object" || typeof payload.id !== "string") {
-            throw new requirement_js_1.RoomException("Invalid create room external oauth registration response payload");
-        }
-        return payload.id;
-    }
-    async updateRoomExternalOAuthRegistration(params) {
-        const { projectId, roomName, registrationId, oauth, clientId, clientSecret, delegatedTo, connector } = params;
-        await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/external-oauth/${registrationId}`, {
-            method: "PUT",
-            json: {
-                oauth,
-                client_id: clientId,
-                client_secret: clientSecret,
-                delegated_to: delegatedTo,
-                connector: this.serializeConnectorRef(connector),
-            },
-            action: "update room external oauth registration",
-            responseType: "void",
-        });
-    }
-    async listRoomExternalOAuthRegistrations(params) {
-        const { projectId, roomName, delegatedTo } = params;
-        const data = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/external-oauth`, {
-            query: {
-                delegated_to: delegatedTo,
-            },
-            action: "list room external oauth registrations",
-        });
-        const registrations = Array.isArray(data?.registrations) ? data.registrations : [];
-        return registrations.map((item) => this.parseExternalOAuthClientRegistration(item));
-    }
-    async deleteRoomExternalOAuthRegistration(params) {
-        const { projectId, roomName, registrationId, delegatedTo } = params;
-        await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/external-oauth/${registrationId}`, {
-            method: "DELETE",
-            query: {
-                delegated_to: delegatedTo,
-            },
-            action: "delete room external oauth registration",
-            responseType: "void",
-        });
-    }
     async createRoom(params) {
-        const { projectId, name, ifNotExists = false, metadata, annotations, permissions } = params;
+        const { projectId, name, ifNotExists = false, metadata, annotations } = params;
         const payload = {
             name,
             if_not_exists: Boolean(ifNotExists),
             metadata,
             annotations,
         };
-        if (permissions) {
-            const serialized = {};
-            for (const [key, value] of Object.entries(permissions)) {
-                serialized[key] = value instanceof participant_token_js_1.ApiScope ? value.toJSON() : value;
-            }
-            payload["permissions"] = serialized;
-        }
         const data = await this.request(`/accounts/projects/${projectId}/rooms`, {
             method: "POST",
             json: payload,
@@ -2037,78 +1754,103 @@ class Meshagent {
             responseType: "void",
         });
     }
-    async connectRoom(projectId, room) {
-        const data = await this.request(`/accounts/projects/${projectId}/rooms/${room}/connect`, {
+    async createGroup(params) {
+        const { projectId, name, metadata, annotations } = params;
+        const data = await this.request(`/accounts/projects/${projectId}/groups`, {
             method: "POST",
-            json: {},
-            action: "connect room",
+            json: { name, metadata, annotations },
+            action: "create group",
         });
-        return this.parseRoomConnectionInfo(data);
+        return this.parseGroup(data);
     }
-    async createRoomGrant(params) {
-        const { projectId, roomId, userId, permissions } = params;
-        await this.request(`/accounts/projects/${projectId}/room-grants`, {
-            method: "POST",
-            json: {
-                room_id: roomId,
-                user_id: userId,
-                permissions: permissions.toJSON(),
-            },
-            action: "create room grant",
+    async getGroup(projectId, groupId) {
+        const data = await this.request(`/accounts/projects/${projectId}/groups/${groupId}`, {
+            action: "fetch group",
+        });
+        return this.parseGroup(data);
+    }
+    async updateGroup(projectId, groupId, name, options = {}) {
+        const payload = { name };
+        if (options.metadata !== undefined) {
+            payload["metadata"] = options.metadata;
+        }
+        if (options.annotations !== undefined) {
+            payload["annotations"] = options.annotations;
+        }
+        await this.request(`/accounts/projects/${projectId}/groups/${groupId}`, {
+            method: "PUT",
+            json: payload,
+            action: "update group",
             responseType: "void",
         });
     }
-    async createRoomGrantByEmail(params) {
-        const { projectId, roomId, email, permissions, inviteRedirectUrl } = params;
-        await this.request(`/accounts/projects/${projectId}/room-grants`, {
-            method: "POST",
-            json: {
-                room_id: roomId,
-                email,
-                permissions: permissions.toJSON(),
-                ...(inviteRedirectUrl !== undefined
-                    ? { invite_redirect_url: inviteRedirectUrl }
-                    : {}),
-            },
-            action: "create room grant",
+    async deleteGroup(projectId, groupId) {
+        await this.request(`/accounts/projects/${projectId}/groups/${groupId}`, {
+            method: "DELETE",
+            action: "delete group",
             responseType: "void",
         });
     }
-    async updateRoomGrant(params) {
-        const { projectId, roomId, userId, permissions, grantId } = params;
-        const gid = grantId ?? "unused";
-        await this.request(`/accounts/projects/${projectId}/room-grants/${gid}`, {
-            method: "PUT",
-            json: {
-                room_id: roomId,
-                user_id: userId,
-                permissions: permissions.toJSON(),
+    async listGroupsPage(projectId, options = {}) {
+        const data = await this.request(`/accounts/projects/${projectId}/groups`, {
+            query: {
+                page_size: options.pageSize ?? 50,
+                continuation_token: options.continuationToken,
+                filter: options.filter,
             },
-            action: "update room grant",
+            action: "list groups",
+        });
+        const groups = Array.isArray(data?.groups) ? data.groups : [];
+        return {
+            groups: groups.map((item) => this.parseGroup(item)),
+            continuationToken: data?.continuation_token ?? null,
+        };
+    }
+    async listGroups(projectId, options = {}) {
+        const page = await this.listGroupsPage(projectId, options);
+        return page.groups;
+    }
+    async setGroupMember(params) {
+        const { projectId, groupId, subject, role = "member" } = params;
+        await this.request(`/accounts/projects/${projectId}/groups/${groupId}/members`, {
+            method: "POST",
+            json: { subject, role },
+            action: "set group member",
             responseType: "void",
         });
     }
-    async deleteRoomGrant(projectId, roomId, userId) {
-        const room = this.encodePathComponent(roomId);
-        const user = this.encodePathComponent(userId);
-        await this.request(`/accounts/projects/${projectId}/room-grants/${room}/${user}`, {
+    async listGroupMembersPage(projectId, groupId, options = {}) {
+        const data = await this.request(`/accounts/projects/${projectId}/groups/${groupId}/members`, {
+            query: { page_size: options.pageSize ?? 50, continuation_token: options.continuationToken },
+            action: "list group members",
+        });
+        const members = Array.isArray(data?.members) ? data.members : [];
+        return { members: members.map((item) => this.parseGroupMember(item)), continuationToken: data?.continuation_token ?? null };
+    }
+    async listGroupMembers(projectId, groupId, options = {}) {
+        const page = await this.listGroupMembersPage(projectId, groupId, options);
+        return page.members;
+    }
+    async deleteGroupMember(params) {
+        const { projectId, groupId, subjectType, subjectId } = params;
+        await this.request(`/accounts/projects/${projectId}/groups/${groupId}/members/${subjectType}/${subjectId}`, {
             method: "DELETE",
-            action: "delete room grant",
+            action: "delete group member",
             responseType: "void",
         });
     }
-    async getRoomGrant(projectId, roomId, userId) {
-        const room = this.encodePathComponent(roomId);
-        const user = this.encodePathComponent(userId);
-        const data = await this.request(`/accounts/projects/${projectId}/room-grants/${room}/${user}`, {
-            action: "fetch room grant",
+    async connectRoom(projectId, room) {
+        const data = await this.request(`/accounts/projects/${projectId}/rooms/${room}/connect`, {
+            method: "POST",
+            json: {},
+            action: "connect room",
         });
-        return this.parseProjectRoomGrant(data);
+        return this.parseRoomConnectionInfo(data);
     }
     async listRooms(projectId, options = {}) {
-        const { limit = 50, offset = 0, orderBy = "room_name" } = options;
+        const { pageSize = 50, continuationToken, filter, view } = options;
         const data = await this.request(`/accounts/projects/${projectId}/rooms`, {
-            query: { limit, offset, order_by: orderBy },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter, view },
             action: "list rooms",
         });
         const rooms = Array.isArray(data?.rooms) ? data.rooms : [];
@@ -2139,16 +1881,23 @@ class Meshagent {
         return this.parseRoute(data.route);
     }
     async listRoutesPage(projectId, options = {}) {
-        const { count = 100, offset = 0, filter } = options;
+        const { pageSize = 100, continuationToken, filter } = options;
         const data = await this.request(`/accounts/projects/${projectId}/routes`, {
-            query: { count, offset, filter },
+            query: { page_size: pageSize, continuation_token: continuationToken, filter },
             action: "list routes",
         });
         const routes = Array.isArray(data.routes) ? data.routes.map((item) => this.parseRoute(item)) : [];
-        return { routes, total: Number(data.total ?? routes.length) };
+        return { routes, total: Number(data.total ?? routes.length), continuationToken: data.continuation_token ?? null };
     }
     async listRoutes(projectId, options = {}) {
-        return (await this.listRoutesPage(projectId, options)).routes;
+        const routes = [];
+        let continuationToken;
+        do {
+            const page = await this.listRoutesPage(projectId, { ...options, continuationToken });
+            routes.push(...page.routes);
+            continuationToken = page.continuationToken ?? undefined;
+        } while (continuationToken);
+        return routes;
     }
     async listRoomRoutesPage(params) {
         const { projectId, roomName, count = 100, offset = 0, filter } = params;
@@ -2184,63 +1933,115 @@ class Meshagent {
             responseType: "void",
         });
     }
-    async listRoomGrants(projectId, options = {}) {
-        const { limit = 50, offset = 0, orderBy = "room_name" } = options;
-        const data = await this.request(`/accounts/projects/${projectId}/room-grants`, {
-            query: { limit, offset, order_by: orderBy },
-            action: "list room grants",
+    async testAccess(projectId, params) {
+        const data = await this.request(`/accounts/projects/${projectId}/access:test`, {
+            method: "POST",
+            json: {
+                subject: this.serializeAccessSubject(params.subject),
+                resource: this.serializeAccessResource(params.resource),
+                relation: params.relation,
+            },
+            action: "test access",
+        });
+        return {
+            allowed: data?.allowed === true,
+            resource: data?.resource && typeof data.resource === "object" ? this.parseAccessResource(data.resource) : undefined,
+            subject: data?.subject && typeof data.subject === "object" ? this.parseAccessSubject(data.subject) : undefined,
+            relation: typeof data?.relation === "string" ? data.relation : undefined,
+        };
+    }
+    async getEffectiveAccess(projectId, params) {
+        const data = await this.request(`/accounts/projects/${projectId}/access:effective`, {
+            method: "POST",
+            json: {
+                subject: this.serializeAccessSubject(params.subject),
+                resource: this.serializeAccessResource(params.resource),
+                ...(params.relations ? { relations: params.relations } : {}),
+            },
+            action: "get effective access",
         });
-        const grants = Array.isArray(data?.room_grants) ? data.room_grants : [];
-        return grants.map((item) => this.parseProjectRoomGrant(item));
+        return {
+            resource: this.parseAccessResource(data?.resource),
+            subject: this.parseAccessSubject(data?.subject),
+            effectiveRoles: Array.isArray(data?.effective_roles) ? data.effective_roles.filter((item) => typeof item === "string") : [],
+            capabilities: data?.capabilities && typeof data.capabilities === "object" ? data.capabilities : {},
+        };
+    }
+    async listAccessBindings(projectId, params) {
+        const page = await this.listAccessBindingsPage(projectId, params);
+        return page.accessGrants;
     }
-    async listRoomGrantsByUser(projectId, userId, options = {}) {
-        const { limit = 50, offset = 0 } = options;
-        const encodedUser = this.encodePathComponent(userId);
-        const data = await this.request(`/accounts/projects/${projectId}/room-grants/by-user/${encodedUser}`, {
-            query: { limit, offset },
-            action: "list room grants by user",
+    async listAccessBindingsPage(projectId, params) {
+        const data = await this.request(`/accounts/projects/${projectId}/access:bindings`, {
+            method: "POST",
+            json: {
+                subject: this.serializeAccessSubject(params.subject),
+            },
+            action: "list access bindings",
         });
-        const grants = Array.isArray(data?.room_grants) ? data.room_grants : [];
-        return grants.map((item) => this.parseProjectRoomGrant(item));
+        return {
+            accessGrants: Array.isArray(data?.access_grants)
+                ? data.access_grants.map((item) => this.parseProjectRoomGrant(item))
+                : [],
+        };
     }
-    async listRoomGrantsByRoom(projectId, roomId, options = {}) {
-        const { limit = 50, offset = 0 } = options;
-        const encodedRoom = this.encodePathComponent(roomId);
-        const data = await this.request(`/accounts/projects/${projectId}/room-grants/by-room/${encodedRoom}`, {
-            query: { limit, offset },
-            action: "list room grants by room",
+    async getResourcePolicyPage(projectId, params) {
+        this.validateResourcePolicyType(params.resourceType);
+        const data = await this.request(`/accounts/projects/${projectId}/iam/${params.resourceType}/${params.resourceId}/policy`, {
+            method: "GET",
+            query: { page_size: params.pageSize ?? 50, continuation_token: params.continuationToken },
+            action: "get resource policy",
         });
-        const grants = Array.isArray(data?.room_grants) ? data.room_grants : [];
-        return grants.map((item) => this.parseProjectRoomGrant(item));
+        return {
+            resource: this.parseAccessResource(data?.resource),
+            accessGrants: Array.isArray(data?.access_grants)
+                ? data.access_grants.map((item) => this.parseProjectRoomGrant(item))
+                : [],
+            continuationToken: typeof data?.continuation_token === "string" ? data.continuation_token : null,
+        };
     }
-    async listUniqueRoomsWithGrants(projectId, options = {}) {
-        const { limit = 50, offset = 0 } = options;
-        const data = await this.request(`/accounts/projects/${projectId}/room-grants/by-room`, {
-            query: { limit, offset },
-            action: "list unique rooms with grants",
+    async getResourcePolicy(projectId, params) {
+        const grants = [];
+        let continuationToken = params.continuationToken;
+        do {
+            const page = await this.getResourcePolicyPage(projectId, { ...params, continuationToken });
+            grants.push(...page.accessGrants);
+            continuationToken = page.continuationToken ?? undefined;
+        } while (continuationToken);
+        return grants;
+    }
+    async grantResourcePolicy(projectId, params) {
+        this.validateResourcePolicyType(params.resourceType);
+        await this.request(`/accounts/projects/${projectId}/iam/${params.resourceType}/${params.resourceId}/policy:grant`, {
+            method: "POST",
+            json: {
+                subject: this.serializeAccessSubject(params.subject),
+                roles: params.roles,
+                ...(params.inviteRedirectUrl ? { invite_redirect_url: params.inviteRedirectUrl } : {}),
+            },
+            action: "grant resource policy",
         });
-        const rooms = Array.isArray(data?.rooms) ? data.rooms : [];
-        return rooms.map((item) => this.parseProjectRoomGrantCount(item));
     }
-    async listUniqueUsersWithGrantsPage(projectId, options = {}) {
-        const { limit = 100, offset = 0, filter } = options;
-        const data = await this.request(`/accounts/projects/${projectId}/room-grants/by-user`, {
-            query: { limit, offset, filter },
-            action: "list unique users with grants",
+    async revokeResourcePolicy(projectId, params) {
+        this.validateResourcePolicyType(params.resourceType);
+        await this.request(`/accounts/projects/${projectId}/iam/${params.resourceType}/${params.resourceId}/policy:revoke`, {
+            method: "POST",
+            json: {
+                subject: this.serializeAccessSubject(params.subject),
+            },
+            action: "revoke resource policy",
         });
-        const users = Array.isArray(data?.users) ? data.users : [];
-        const parsed = users.map((item) => this.parseProjectUserGrantCount(item));
-        return { users: parsed, total: typeof data?.total === "number" ? data.total : parsed.length };
     }
-    async listUniqueUsersWithGrants(projectId, options = {}) {
-        const page = await this.listUniqueUsersWithGrantsPage(projectId, options);
-        return page.users;
+    validateResourcePolicyType(resourceType) {
+        if (resourceType === "agent") {
+            throw new Error("managed agent resource policies are not supported; use agent run_as instead");
+        }
     }
     async createOAuthClient(projectId, params) {
-        const { grantTypes, responseTypes, redirectUris, scope, metadata = {} } = params;
+        const { grantTypes, responseTypes, redirectUris, scope, metadata = {}, official = false } = params;
         const data = await this.request(`/accounts/projects/${projectId}/oauth/clients`, {
             method: "POST",
-            json: { grant_types: grantTypes, response_types: responseTypes, redirect_uris: redirectUris, scope, metadata },
+            json: { grant_types: grantTypes, response_types: responseTypes, redirect_uris: redirectUris, scope, metadata, official },
             action: "create oauth client",
         });
         return this.parseOAuthClient(data);