@revoengine/sdk 1.6.3 → 1.6.4

package/README.md

@@ -1,12 +1,12 @@
 # @revoengine/sdk
 
 Official Node.js SDK for RevoEngine. It provides the modern `api`, `utils`,
-`storage`, `transport`, `vault`, and `agents` namespaces, top-level `execute()`, and the `batch` controller in both
+`storage`, `transport`, `vault`, `serviceAccount`, and `agents` namespaces, top-level `execute()`, and the `batch` controller in both
 Revo-hosted `CUSTOM_NODEJS` components and standalone Node.js applications.
 
 Requirements: Node.js 22 or newer.
 
-## SDK 1.6.3 compatibility
+## SDK 1.6.4 compatibility
 
 This release synchronizes the complete public SDK contract with the current
 platform low-code declarations. Remote calls require a platform runtime that admits
@@ -28,7 +28,7 @@ Legacy SFTP helpers and the removed thread-goal methods are not exposed by the
 current SDK contract. Refer to the [transfer guide](https://docs.revoengine.com/low-code/sftp)
 for Secret formats and file-transfer examples.
 
-SDK 1.6.3 retains portable Component digest declarations and one readable-relation
+SDK 1.6.4 retains portable Component digest declarations and one readable-relation
 contract for Databases, live Views, and Materialized Views. Use `api.exportDatabase()`
 for all three relation types. `api.getDatabaseViewData()` remains a deprecated
 read alias; `api.exportDatabaseView()` and separate REST View export operations
@@ -55,14 +55,14 @@ provider consent, Vault binding, and tool permissions before enabling a plugin.
 | Revo-hosted `CUSTOM_NODEJS` | Export `async function init(runtime)` | Revo injects an execution-bound runtime; user code receives no API key. |
 | Standalone Node.js | Create `new RevoClient(options)` | Supply a RevoEngine API key explicitly or through an environment variable. |
 
-Both modes expose the same `api`, `utils`, `storage`, `transport`, `vault`, `agents`, `execute`, and `batch`
+Both modes expose the same `api`, `utils`, `storage`, `transport`, `vault`, `serviceAccount`, `agents`, `execute`, and `batch`
 properties, but return types reflect where the work happens:
 
 | Call kind | Revo-hosted | Standalone |
 | --- | --- | --- |
 | Execution snapshot, cache, debug, and logging | Synchronous | Throws synchronously because no execution context exists |
 | Current user and instance | Synchronous injected snapshot | Asynchronous lazy `/api/v1/me` discovery |
-| Remote `api`, `storage`, `transport`, `vault`, `agents`, and `execute()` calls | Asynchronous | Asynchronous |
+| Remote `api`, `storage`, `transport`, `vault`, `serviceAccount`, `agents`, and `execute()` calls | Asynchronous | Asynchronous |
 | Local `utils` and `batch.configure()` | Synchronous unless the utility is inherently asynchronous | Same |
 
 ## Installation
@@ -79,7 +79,7 @@ RevoEngine pins that version again in the deployment package and injects the
 runtime into the component entrypoint. Component code does not construct a
 `RevoClient`.
 
-The platform chooses the hosted package version; publishing SDK 1.6.3 does not
+The platform chooses the hosted package version; publishing SDK 1.6.4 does not
 upgrade existing hosted deployments or their generated package pins.
 
 Hosted user code receives neither a tenant API key nor the private runtime
@@ -156,6 +156,8 @@ Execution-only methods such as `api.input()`, `api.getContext()`,
 `api.getExecutionId()`, and `api.getOperationId()` are available only in hosted
 executions.
 
+Use `runtime.execute(code, { readOnly: true })` for transient code that must not write platform state. `readOnly: false` selects full execution for an authorized standalone client; a hosted execution inherits its mode and cannot escalate a restricted parent.
+
 ### Configure hosted batching
 
 Configure batching before the first remote call:
@@ -809,7 +811,7 @@ await client.vault.rotate('TOKEN', { value: replacement }, { scope: 'user', vali
 Do not log values or access tokens. Instance access requires Secret roles and
 creator ownership or administrator rights. User scope uses the verified account;
 management requires owner rights and does not inherit saved Component/Tool grants.
-Writes return null in debug/read-only execution. See the
+Writes throw `READ_ONLY_OPERATION_FORBIDDEN` when the execution has `readOnly: true`. See the
 [Vault guide](https://docs.revoengine.com/low-code/reference/vault) for all methods.
 
 The same flat manager exposes `getAccessToken`, `getIntegrationMetadata`,

package/dist/{errors-BF0cw_Ut.d.cts → errors-BA9TUmFF.d.cts}

@@ -1,10 +1,10 @@
 import * as node_worker_threads from 'node:worker_threads';
 import { Buffer as Buffer$1 } from 'node:buffer';
 
-declare const SDK_VERSION: "1.6.3";
+declare const SDK_VERSION: "1.6.4";
 declare const PROTOCOL_VERSION: 1;
-declare const CONTRACT_REVISION: "8083c90249a517982be7395a44c016ab08dcd047eb9b12231211e496c842120d";
-type RuntimeSurfaceName = 'api' | 'storage' | 'transport' | 'vault' | 'agents' | 'lowCode';
+declare const CONTRACT_REVISION: "d2b7e94d335d87dd070d2a97a043704b61b8c8d5c28435c20aceeda9581b70e4";
+type RuntimeSurfaceName = 'api' | 'storage' | 'transport' | 'vault' | 'serviceAccount' | 'agents' | 'lowCode';
 
 // AUTO-GENERATED FILE. DO NOT EDIT DIRECTLY.
 // Sources: api.swagger-contracts.generated.d.ts, api.public.d.ts
@@ -57,6 +57,8 @@ interface SwaggerAgentConfigDto {
     "persona"?: "friendly" | "pragmatic" | "professional" | "concise" | "calm" | "mentor" | "assertive";
     /** Additional per-agent system instructions persisted with the definition. Runtime policy still has higher priority. */
     "systemInstructions"?: string;
+    /** One persistent Agent memory shared by Memory settings and runtime memory tools, included in instructions on every turn. Limited to 20,000 assistant tokens. */
+    "memory"?: string;
     /** Structured operator-owned Agent identity loaded on every autonomous turn. Learned memory cannot mutate this definition. */
     "definition"?: SwaggerAgentDefinitionDto;
     /** Durable cross-run memory defaults such as recall budget, retained summary size, and retention horizon. */
@@ -71,6 +73,10 @@ interface SwaggerAgentConfigDto {
     "toolNames"?: Array<string>;
     /** Default registry plugin ids attached to this agent. These are the agent-owned baseline attachments applied to every run unless additional runtime plugin ids are supplied. */
     "pluginIds"?: Array<string>;
+    /** Attached or inherited default registry plugin IDs to load eagerly. IDs outside the effective Agent plugin access set are rejected. */
+    "eagerPluginIds"?: Array<string>;
+    /** Selected terminal IDs available to this Agent. An empty selection permits no terminals. Each use also requires the historical execution service account and its current terminal/workspace ACL. */
+    "agentTerminalIds"?: Array<string>;
     /** Primary plugin contract surface. Plugins are provider-governed and define the executable agent-plugin surface. */
     "plugins"?: Array<SwaggerAgentPluginConfigDto>;
     /** Maximum number of concurrently admitted root runs for this agent. Additional root runs remain queued until capacity is released. */
@@ -477,6 +483,39 @@ interface SwaggerDatabaseIndexPredicateDto {
 interface SwaggerDatabaseOptionsDto {
     "indexes"?: Array<SwaggerDatabaseIndexDefinitionDto>;
 }
+interface SwaggerDatabaseViewActionExecuteDto {
+    "action": "UPDATE" | "DELETE";
+    "targetDatabaseId": string;
+    "keyMapping": Record<string, unknown>;
+    "mutationToken": string;
+    "data"?: Record<string, unknown> | Array<{
+        "column": string;
+        "op": "set" | "setNull" | "add" | "subtract" | "multiply" | "divide" | "abs" | "floor" | "ceil" | "sqrt" | "round" | "pow" | "toggle" | "addInterval" | "subtractInterval" | "truncate" | "prepend" | "append" | "insert" | "replace" | "trim" | "lower" | "upper" | "mergeJson" | "setJsonPath" | "removeJsonPath" | "addItems" | "removeItems";
+        "value"?: unknown | null;
+        "position"?: number;
+        "search"?: string;
+        "path"?: Array<string>;
+        "create"?: boolean;
+        "unit"?: string;
+        "nulls"?: "preserve" | "empty";
+    }>;
+    "return"?: boolean;
+    "onlyKeys"?: boolean;
+}
+interface SwaggerDeleteDatabaseRequestDto {
+    /** Filter object or array of filter objects. */
+    "filter": Record<string, unknown>;
+    /** Join definition for filtering. */
+    "join"?: Record<string, unknown>;
+    /** Limit of affected rows. */
+    "take"?: number;
+    /** Offset of affected rows. */
+    "skip"?: number;
+    /** Return updated rows. */
+    "return"?: boolean;
+    /** Return only primary keys (reduces payload). */
+    "onlyKeys"?: boolean;
+}
 interface SwaggerPartitionDefinition {
     /** Partition type. */
     "type"?: "LIST" | "RANGE" | "HASH";
@@ -505,6 +544,36 @@ interface SwaggerPartitionDefinition {
        */
     "remainder"?: number;
 }
+interface SwaggerServiceAccountAccessDto {
+    /** Restrict management access to explicitly assigned users and groups. */
+    "restricted": boolean;
+    /** User UUID/email references or {id}/{mail}. No implicit creator/self access after creation. */
+    "users"?: Array<string | {
+        "id": string;
+    } | {
+        "mail": string;
+    }>;
+    /** Exact group name/UUID references or {id}/{name}. */
+    "groups"?: Array<string | {
+        "id": string;
+    } | {
+        "name": string;
+    }>;
+}
+interface SwaggerServiceAccountMembershipsDto {
+    /** Execution group memberships. Requires USER_ADMIN or INSTANCE_ADMIN. */
+    "groups"?: Array<string | {
+        "id": string;
+    } | {
+        "name": string;
+    }>;
+    /** Assigned active role groups. Delegators may assign only their own active groups without INSTANCE_ADMIN. */
+    "roleGroups"?: Array<string | {
+        "id": string;
+    } | {
+        "name": string;
+    }>;
+}
 interface SwaggerStorageCellInputDto {
     /** A1 cell address. */
     "address": string;
@@ -512,7 +581,7 @@ interface SwaggerStorageCellInputDto {
     "value"?: string | number | boolean | Record<string, unknown> | Array<unknown> | null;
     /** Excel formula without a leading equals sign. */
     "formula"?: string;
-    /** Cached formula result. ExcelJS does not calculate formulas. Supports JSON-compatible strings, numbers, booleans, arrays, objects, and null. */
+    /** Cached formula result. Formulas are not calculated by this operation. Supports JSON-compatible strings, numbers, booleans, arrays, objects, and null. */
     "result"?: string | number | boolean | Record<string, unknown> | Array<unknown> | null;
     /** Declarative cell style for XLSX output. */
     "style"?: Record<string, unknown>;
@@ -588,6 +657,30 @@ interface SwaggerStorageTabularSchemaPolicyDto {
     /** How undeclared source columns are handled. allow retains them, strip omits them from structured rows, and reject fails indexing. Defaults to allow for fallback and reject for strict. The raw file is preserved. */
     "additionalProperties"?: "allow" | "strip" | "reject";
 }
+interface SwaggerUpdateServiceAccountAccessDto {
+    /** Restrict management access to explicitly assigned users and groups. */
+    "restricted"?: boolean;
+    /** User UUID/email references or {id}/{mail}. No implicit creator/self access after creation. */
+    "users"?: Array<string | {
+        "id": string;
+    } | {
+        "mail": string;
+    }>;
+    /** Exact group name/UUID references or {id}/{name}. */
+    "groups"?: Array<string | {
+        "id": string;
+    } | {
+        "name": string;
+    }>;
+}
+interface SwaggerUserKeyWhitelistDto {
+    /** You need to provide name of the user. */
+    "name": string;
+    /** You need to provide type of whitelist IP,IP_SUBNET,RANGE. */
+    "type": string;
+    /** Provide a single address, a CIDR network or an address range. */
+    "value": string;
+}
 interface SwaggerWebhookMapPatchDto {
     "set"?: Record<string, string>;
     "remove"?: Array<string>;
@@ -702,6 +795,18 @@ interface DatabaseCreateInput {
     /** Advanced structured table options, including composite, expression, covering, and partial indexes. */
     "options"?: SwaggerDatabaseOptionsDto;
 }
+interface ServiceAccountKeyCreateInput {
+    /** You need to provide name of the user. */
+    "name": string;
+    /** Optional resource metadata. Top-level keys starting with "__" are reserved for backend use. */
+    "metadata"?: Record<string, unknown> | null;
+    /** You can provide if key should be whitelisted. */
+    "restricted": boolean;
+    /** Use an empty array or null when restricted is false; provide at least one complete entry when restricted is true. */
+    "whitelist"?: Array<SwaggerUserKeyWhitelistDto> | null;
+    /** Optional API key expiration timestamp. When provided, it must be at least four hours in the future. */
+    "expireAt"?: string;
+}
 interface AssistantMessageInput {
     /** Finalized Storage files to link to this message. File access is checked on send and every read. */
     "storageEntryIds"?: Array<string>;
@@ -740,6 +845,20 @@ interface AssistantMessageInput {
     /** Optional per-turn backend performance debugger. When true, payload build timing traces are persisted into assistant report artifacts, and local/test runtimes may persist hidden model-call snapshots for this turn. */
     "performanceDebugger"?: boolean;
 }
+interface ServiceAccountCreateInput {
+    "access"?: SwaggerServiceAccountAccessDto;
+    "memberships"?: SwaggerServiceAccountMembershipsDto;
+    /** You need to provide name of the user. */
+    "name": string;
+    /** Custom service-account metadata. Top-level keys starting with "__" are reserved for backend use. Maximum 16 KiB of UTF-8 JSON and 64 top-level keys. */
+    "metadata"?: Record<string, unknown> | null;
+    /** Custom service-account metadata. Top-level keys starting with "__" are reserved for backend use. Maximum 16 KiB of UTF-8 JSON and 64 top-level keys. */
+    "metaData"?: Record<string, unknown> | null;
+    /** Extended account data with separate permissions. Same JSON format as Metadata. Maximum 16 KiB of UTF-8 JSON and 64 top-level keys. */
+    "metadataAdvanced"?: Record<string, unknown> | null;
+    /** Extended account data with separate permissions. Same JSON format as Metadata. Maximum 16 KiB of UTF-8 JSON and 64 top-level keys. */
+    "advancedData"?: Record<string, unknown> | null;
+}
 interface StorageFolderInput {
     /** Folder name. */
     "name": string;
@@ -814,6 +933,31 @@ interface StorageUploadSessionInput {
     /** Explicit allowed user ids for the finalized entry. */
     "users"?: Array<string>;
 }
+interface DatabaseOperationInput {
+    /** Database ID/name, or view ID when viewAction is provided. */
+    "databaseName": string;
+    "action": "UPDATE" | "DELETE" | "TRUNCATE";
+    /** Filtered selection. Returning rows is not supported in background operations. */
+    "request"?: SwaggerDeleteDatabaseRequestDto;
+    "data"?: Record<string, unknown> | Array<{
+        "column": string;
+        "op": "set" | "setNull" | "add" | "subtract" | "multiply" | "divide" | "abs" | "floor" | "ceil" | "sqrt" | "round" | "pow" | "toggle" | "addInterval" | "subtractInterval" | "truncate" | "prepend" | "append" | "insert" | "replace" | "trim" | "lower" | "upper" | "mergeJson" | "setJsonPath" | "removeJsonPath" | "addItems" | "removeItems";
+        "value"?: unknown | null;
+        "position"?: number;
+        "search"?: string;
+        "path"?: Array<string>;
+        "create"?: boolean;
+        "unit"?: string;
+        "nulls"?: "preserve" | "empty";
+    }>;
+    /** Reviewed view mutation. The preview token is validated at admission. */
+    "viewAction"?: SwaggerDatabaseViewActionExecuteDto;
+    "restartIdentity"?: boolean;
+    /** Suppress the terminal System message. Low-code defaults this to true. */
+    "skipNotification"?: boolean;
+    /** Actor-scoped admission key. Reusing it with a different request is rejected. */
+    "idempotencyKey"?: string;
+}
 interface StorageUploadSessionFinalizeInput {
     /** Expected contiguous multipart count (parts 1..N). Use this to fence distributed uploads against missing parts. */
     "expectedPartCount"?: number;
@@ -887,6 +1031,32 @@ interface StoragePutObjectInput {
   FROZEN: Deep archive or legal-hold data kept mainly for audit or recovery obligations. */
     "tier"?: "HOT" | "WARM" | "COLD" | "FROZEN";
 }
+interface ServiceAccountQuery {
+    /** Number of rows to skip before pagination starts. Parsed from a query-string integer. */
+    "skip"?: number;
+    /** Maximum number of rows to return. Parsed from a query-string integer. Most list endpoints default to 100 when omitted. */
+    "take"?: number;
+    /** Include the total count in the response envelope only when explicitly true. Omitted or false skips the count query. */
+    "count"?: boolean;
+    /** Filter tree as a JSON string or bracket-style query object. Supports and/or/not groups and field predicates with ops such as eq, ne, gt, gte, lt, lte, like, notLike, ilike, notILike, in, notIn, any, isNull, isNotNull, between, contains, containedBy, arrayHas, arrayHasAny, arrayHasAll, arrayContainedBy, jsonArrayHas, jsonArrayHasAny, jsonArrayHasAll, startsWith, endsWith, true, and false. Field names are allowed logical fields; relation fields use dot paths such as groups.groupId when exposed by the endpoint. */
+    "filter"?: string;
+    /** Sort definition as a JSON string, indexed array query object, array, or legacy CSV. JSON object values should be ASC or DESC. CSV supports descending fields with a leading dash, for example name,-lastUpdateAt. */
+    "sort"?: string;
+    /** Optional DISTINCT ON logical fields as a JSON array string, indexed array query object, array, or legacy CSV. Selected distinct fields are included in the projection. */
+    "distinct"?: string;
+    /** Optional field projection as a JSON array string, indexed array query object, array, or legacy CSV. String fields must be allowlisted logical fields. Advanced select items may use field, fn, raw, cast, coalesce, or case expressions when the endpoint enables dynamic projection. */
+    "fields"?: string;
+    /** Optional join definitions as a JSON string or bracket-style query object. This is only honored by endpoints that explicitly enable dynamic joins, such as dynamic database data reads. Each join has table, alias, type (left or inner), and an on condition. */
+    "joins"?: string;
+    /** Optional groupBy logical fields as a JSON array string, indexed array query object, array, or legacy CSV. Only honored when the endpoint enables dynamic grouping or already has grouped defaults. */
+    "groupBy"?: string;
+    /** Optional cast mapping as a JSON string or bracket-style query object. Keys are selected aliases or logical fields; values are database definition types such as TEXT, INTEGER, BIGINT, NUMERIC, BOOLEAN, DATE, TIMESTAMP, TIMESTAMPTZ, JSON, JSONB, or UUID where supported. */
+    "cast"?: string;
+    /** Optional CTE definitions as a JSON string or bracket-style query object. Only honored by endpoints that explicitly enable dynamic CTEs. */
+    "with"?: string;
+    /** Enable debug output for the request, including compiled SQL, bound params, and bounded EXPLAIN plans when the endpoint supports it. */
+    "debug"?: boolean;
+}
 interface AssistantActionResolutionInput {
     /** Finalized Storage files linked to this action response. */
     "storageEntryIds"?: Array<string>;
@@ -925,9 +1095,21 @@ interface StorageRestoreInput {
     /** Required for TTL-expired entries. Use null to restore without another expiration. */
     "retention"?: SwaggerStorageRetentionDto | null;
 }
+interface ServiceAccountKeyRotateInput {
+    /** Current API key version. */
+    "version": number;
+    /** Old-key overlap in milliseconds. Zero revokes the old key immediately. Existing expiration is never extended. */
+    "gracePeriodMs"?: number;
+    /** New-key ISO expiration, at least four hours ahead. Omission inherits the current expiration; null creates a key without expiration. */
+    "expireAt"?: string | null;
+    /** Authenticator confirmation for personal accounts. */
+    "code"?: string;
+}
 interface AgentRunInput {
     /** Instruction or mission passed to the root agent run. */
     "instruction": string;
+    /** Readable Agent-workspace storage entries attached to the first conversation message. */
+    "storageEntryIds"?: Array<string>;
     /** Optional trigger type such as REQUEST, EVENT, or SCHEDULE. */
     "triggerType"?: string;
     /** Optional external reference type for correlation. */
@@ -1005,6 +1187,36 @@ interface DatabaseUpdateInput {
     /** Provide current version. */
     "version": number;
 }
+interface ServiceAccountKeyUpdateInput {
+    /** You need to provide name of the user. */
+    "name"?: string;
+    /** Replacement resource metadata. Top-level keys starting with "__" are reserved for backend use. */
+    "metadata"?: Record<string, unknown> | null;
+    /** You can provide if key should be whitelisted. */
+    "restricted"?: boolean;
+    /** Use an empty array or null when restricted is false; provide at least one complete entry when setting restricted to true. */
+    "whitelist"?: Array<SwaggerUserKeyWhitelistDto> | null;
+    /** Current API key version used for optimistic concurrency control. */
+    "version": number;
+    /** Optional six-character confirmation code when required by the account policy. */
+    "code"?: string;
+}
+interface ServiceAccountUpdateInput {
+    "memberships"?: SwaggerServiceAccountMembershipsDto;
+    /** You need to provide name of the user. */
+    "name"?: string;
+    /** Custom service-account metadata. Top-level keys starting with "__" are reserved for backend use. Maximum 16 KiB of UTF-8 JSON and 64 top-level keys. */
+    "metadata"?: Record<string, unknown> | null;
+    /** Custom service-account metadata. Top-level keys starting with "__" are reserved for backend use. Maximum 16 KiB of UTF-8 JSON and 64 top-level keys. */
+    "metaData"?: Record<string, unknown> | null;
+    /** Extended account data with separate permissions. Same JSON format as Metadata. Maximum 16 KiB of UTF-8 JSON and 64 top-level keys. */
+    "metadataAdvanced"?: Record<string, unknown> | null;
+    /** Extended account data with separate permissions. Same JSON format as Metadata. Maximum 16 KiB of UTF-8 JSON and 64 top-level keys. */
+    "advancedData"?: Record<string, unknown> | null;
+    "access"?: SwaggerUpdateServiceAccountAccessDto;
+    /** Current account version for optimistic concurrency. */
+    "version": number;
+}
 interface StorageEntryUpdateInput {
     /** Replacement file retention. Omit to preserve, or set null to clear expiration. */
     "retention"?: SwaggerStorageRetentionDto | null;
@@ -1046,8 +1258,8 @@ interface WebhookInput {
     "saveDetails"?: boolean;
     /** Stop delivery on a supported attempt status. Processing of delivery logs is asynchronous. */
     "stopOnStatuses"?: Array<"UNAUTHENTICATED">;
-    /** Max attempts. */
-    "maxAttempts"?: number;
+    /** Additional retries after the first request: -1 unlimited, 0 no retry, N up to N retries. */
+    "maxRetries"?: number;
     /** Provide data */
     "request"?: SwaggerWebhookRequestDetailsDto;
     /** Mask request details. */
@@ -1592,7 +1804,8 @@ interface Webhook {
     status: string;
     statusMessage: string;
     attempts: number;
-    maxAttempts: number;
+    /** Additional retries: -1 unlimited, 0 no retry. */
+    maxRetries: number;
     request: LooseObject<any>;
     response: LooseObject<any>;
     createdBy: string;
@@ -2107,7 +2320,7 @@ type ExportDatabaseOptions = Omit<SelectInput, 'from'> & {
      * Default is false.
      */
     async?: boolean;
-    /** Suppress the export completion/failure System notification for this low-code call. */
+    /** Suppress the export completion/failure System notification. Defaults to true for low-code; set false to opt in. */
     skipNotification?: boolean;
     /** Output format. CSV is the default. XLSX validates the effective row count before starting. */
     format?: 'csv' | 'tsv' | 'ndjson' | 'xlsx';
@@ -2130,6 +2343,8 @@ type ExportDatabaseOptions = Omit<SelectInput, 'from'> & {
     retention?: StorageRetentionInput;
 };
 type ImportDatabaseOptions = {
+    /** Suppress System messages; defaults to true in low-code. */
+    skipNotification?: boolean;
     storageEntryId: string;
     format: 'csv' | 'tsv' | 'ndjson' | 'xlsx';
     mode: 'insert' | 'upsert';
@@ -2476,12 +2691,18 @@ interface AgentConfig {
     workMode?: AgentWorkMode;
     persona?: AgentPersona;
     systemInstructions?: string;
+    /** Persistent Agent Memory shared with memory tools and included in every instruction packet; at most 20,000 o200k_base tokens. */
+    memory?: string;
     memoryPolicy?: AgentMemoryPolicy;
     release?: AgentReleaseConfig;
     automation?: AgentAutomationPolicyConfig;
     cheapTurn?: AgentCheapTurnPolicy;
     toolNames?: string[];
     pluginIds?: string[];
+    /** Attached or inherited default plugins to preload; at most 64 IDs, all within the effective Agent access set. */
+    eagerPluginIds?: string[];
+    /** Selected terminals narrow the historical execution service account's current ACL; at most 64 IDs, empty permits none. */
+    agentTerminalIds?: string[];
     plugins?: AgentPluginConfig[];
     maxActiveRootRuns?: number;
     maxChildRuns?: number;
@@ -2862,7 +3083,7 @@ interface SecretWithRevision extends Secret {
     revision: SecretRevision;
 }
 interface SecretValueRevision extends SecretRevision {
-    value: Buffer;
+    value: string;
 }
 interface SecretWithValue extends Secret {
     revision: SecretValueRevision;
@@ -2921,6 +3142,86 @@ interface VaultIntegrationConnectResult {
     revision: string;
     authorizationUrl: string;
 }
+/** Native Vault manager; one contract for instance and verified user ownership.
+ * Instance access requires Secret roles and creator ownership or an administrator.
+ * Secret values return only through get; getAccessToken returns an integration token. Automatic diagnostic previews suppress Secret values.
+ * Writes with readOnly: true throw READ_ONLY_OPERATION_FORBIDDEN before performing the operation.
+ * External provider credentials and OAuth connections have their own lifecycles.
+ */
+/** Unique service-account name or ID; explicit selectors avoid ambiguity. */
+type ServiceAccountRef = string | {
+    id: string;
+} | {
+    name: string;
+};
+interface ServiceAccountRecord {
+    userId: string;
+    name: string;
+    mail: string;
+    serviceAccount: true;
+    status: number;
+    version: number;
+    platformAccess: boolean;
+    access: {
+        restricted: boolean;
+        users: Array<{
+            userId: string;
+            mail: string;
+            name: string;
+        }>;
+        groups: Array<{
+            groupId: string;
+            name: string;
+        }>;
+    };
+    memberships: {
+        groups: string[];
+        roleGroups: string[];
+    };
+    metadata: Record<string, any>;
+    metadataAdvanced: Record<string, any>;
+}
+interface ServiceAccountKey {
+    userKeyId: string;
+    name: string;
+    version: number;
+    /** Masked credential label; never the usable credential. */
+    key?: string;
+    restricted: boolean;
+    whitelist?: ServiceAccountKeyCreateInput['whitelist'];
+    expireAt?: Date | null;
+    metadata?: Record<string, any>;
+    deletedAt?: Date | null;
+    createdAt?: Date;
+    lastUpdateAt?: Date;
+    rotatedFromUserKeyId?: string | null;
+}
+/** Immutable credentials are revealed once by create/rotate only. */
+interface ServiceAccountKeyCreated extends ServiceAccountKey {
+    secret: string;
+}
+interface ServiceAccountKeyRotated {
+    newKey: ServiceAccountKeyCreated;
+    previousKey: ServiceAccountKey;
+}
+interface RevoServiceAccount {
+    get(ref: ServiceAccountRef): Promise<ServiceAccountRecord>;
+    list(query?: ServiceAccountQuery): Promise<CollectionResult<ServiceAccountRecord>>;
+    create(input: ServiceAccountCreateInput): Promise<ServiceAccountRecord>;
+    update(ref: ServiceAccountRef, input: ServiceAccountUpdateInput): Promise<ServiceAccountRecord>;
+    delete(ref: ServiceAccountRef): Promise<ServiceAccountRecord>;
+    activate(ref: ServiceAccountRef): Promise<ServiceAccountRecord>;
+    disable(ref: ServiceAccountRef): Promise<ServiceAccountRecord>;
+    restore(ref: ServiceAccountRef): Promise<ServiceAccountRecord>;
+    enablePlatformAccess(ref: ServiceAccountRef): Promise<ServiceAccountRecord>;
+    disablePlatformAccess(ref: ServiceAccountRef): Promise<ServiceAccountRecord>;
+    getKeys(ref: ServiceAccountRef, query?: ServiceAccountQuery): Promise<CollectionResult<ServiceAccountKey>>;
+    getKey(ref: ServiceAccountRef, userKeyId: string): Promise<ServiceAccountKey>;
+    createKey(ref: ServiceAccountRef, input: ServiceAccountKeyCreateInput): Promise<ServiceAccountKeyCreated>;
+    updateKey(ref: ServiceAccountRef, userKeyId: string, input: ServiceAccountKeyUpdateInput): Promise<ServiceAccountKey>;
+    rotateKey(ref: ServiceAccountRef, userKeyId: string, input: ServiceAccountKeyRotateInput): Promise<ServiceAccountKeyRotated>;
+    revokeKey(ref: ServiceAccountRef, userKeyId: string): Promise<ServiceAccountKey>;
+}
 interface RevoVault$1 {
     get(name: string, options?: SecretGetOptions): Promise<SecretWithValue>;
     create(name: string, data: SecretCreateInput, options?: SecretScopeOptions): Promise<Secret | null>;
@@ -2945,6 +3246,11 @@ interface RevoApi {
     exportDatabase<TAsync extends boolean = false>(name: string, options?: ExportDatabaseOptions & {
         async?: TAsync;
     }): Promise<TAsync extends true ? ExportDatabaseAcceptedResponse : TAsync extends false ? ExportDatabaseCompletedResponse : ExportDatabaseResponse>;
+    startDatabaseOperation(name: string, options: Omit<DatabaseOperationInput, 'databaseName'>): Promise<{
+        accepted: true;
+        jobId: string;
+        status: string;
+    }>;
     importDatabase(name: string, options: ImportDatabaseOptions): Promise<{
         importId: string;
         jobId: string;
@@ -2989,8 +3295,6 @@ interface RevoApi {
     queryDatabase(query: string, params?: any[]): Promise<any>;
     currentUser(): LoggedUser;
     isDebug(): boolean;
-    disableDebug(): void;
-    enableDebug(): void;
     getCache(key: string): any;
     setCache(key: string, value: any): void;
     getContext(): Context;
@@ -3321,6 +3625,8 @@ type LowCodeLanguage = 'javascript' | 'typescript';
 interface LowCodeExecuteOptions {
     /** Defaults to TypeScript. */
     language?: LowCodeLanguage;
+    /** Restrict platform writes for this execution. Inherits the hosted runtime mode when omitted. */
+    readOnly?: boolean;
     /** Input exposed through api.input() inside the low-code execution. */
     inputs?: any;
     /** Maximum execution time in milliseconds. Defaults to 60 seconds. */
@@ -3429,6 +3735,7 @@ interface RevoRuntime {
     readonly utils: RevoUtils;
     readonly storage: RevoStorage;
     readonly vault: RevoVault;
+    readonly serviceAccount: RevoServiceAccount;
     readonly transport: RevoTransport;
     readonly agents: RevoAgents;
     readonly execute: RevoExecute;
@@ -3527,4 +3834,4 @@ declare class RevoHttpResponseError extends RevoError {
     constructor(statusCode: number, body?: unknown);
 }
 
-export { RevoRemoteError as A, type BatchFailureMode as B, CONTRACT_REVISION as C, RevoRuntimeContextUnavailableError as D, RevoTransportError as E, type RuntimeBatchRequest as F, type RuntimeBatchResponse as G, type HostedRuntimeBootstrap as H, type RuntimeCall as I, type RuntimeCallResult as J, type SerializedRevoError as K, PROTOCOL_VERSION as P, type RevoRuntime as R, SDK_VERSION as S, RevoExecutionExit as a, RevoHttpResponseError as b, type RevoRuntimeBridgeRequest as c, type RevoRuntimeBridgeResponse as d, type RevoRuntimeBridgeTransportError as e, type RevoStandaloneApi as f, type RevoUtils as g, type RevoStorage as h, type RevoVault as i, type RevoTransport as j, type RevoAgents as k, type RevoExecute as l, type RevoBatchController as m, type RevoClientOptions as n, type RevoApi as o, RevoAuthenticationError as p, RevoBatchConfigurationError as q, RevoBatchLimitError as r, type RevoBatchLimits as s, type RevoBatchOptions as t, RevoConfigurationError as u, RevoError as v, type RevoExecuteOptions as w, type RevoExecutionDefaults as x, RevoPermissionDeniedError as y, RevoProtocolError as z };
+export { RevoProtocolError as A, type BatchFailureMode as B, CONTRACT_REVISION as C, RevoRemoteError as D, RevoRuntimeContextUnavailableError as E, RevoTransportError as F, type RuntimeBatchRequest as G, type HostedRuntimeBootstrap as H, type RuntimeBatchResponse as I, type RuntimeCall as J, type RuntimeCallResult as K, type SerializedRevoError as L, PROTOCOL_VERSION as P, type RevoRuntime as R, SDK_VERSION as S, RevoExecutionExit as a, RevoHttpResponseError as b, type RevoRuntimeBridgeRequest as c, type RevoRuntimeBridgeResponse as d, type RevoRuntimeBridgeTransportError as e, type RevoStandaloneApi as f, type RevoUtils as g, type RevoStorage as h, type RevoVault as i, type RevoServiceAccount as j, type RevoTransport as k, type RevoAgents as l, type RevoExecute as m, type RevoBatchController as n, type RevoClientOptions as o, type RevoApi as p, RevoAuthenticationError as q, RevoBatchConfigurationError as r, RevoBatchLimitError as s, type RevoBatchLimits as t, type RevoBatchOptions as u, RevoConfigurationError as v, RevoError as w, type RevoExecuteOptions as x, type RevoExecutionDefaults as y, RevoPermissionDeniedError as z };