@structured-id/ui-core 1.2.0 → 2.0.0

package/src/generated/sid/v1/projects/projects.ts

@@ -50,94 +50,312 @@ export interface Project {
     updatedAt?: Timestamp;
 }
 /**
- * Application represents an OIDC client within a project.
+ * A managed application: the registration of one product or integration in a
+ * project. It has an OAuth client role (software that obtains tokens), a
+ * protected-resource role (an API or application at which access is
+ * enforced), or both. The roles are independent: a resource needs no client,
+ * secret or callback of its own, and a client obtains tokens only for
+ * resources it has explicit access to.
  *
  * @generated from protobuf message sid.v1.projects.Application
  */
 export interface Application {
     /**
-     * @generated from protobuf field: string client_id = 1
+     * Server-assigned application identifier (UUIDv7). Stable for the
+     * application's lifetime; not a credential and not a token audience.
+     *
+     * @generated from protobuf field: string id = 1
      */
-    clientId: string;
+    id: string;
     /**
+     * Project (UUID) whose authorization vocabulary the application uses.
+     *
      * @generated from protobuf field: string project_id = 2
      */
     projectId: string;
     /**
+     * Name shown to administrators.
+     *
      * @generated from protobuf field: string name = 3
      */
     name: string;
     /**
-     * @generated from protobuf field: sid.v1.projects.ApplicationType type = 4
+     * The OAuth client role, when the application has one.
+     *
+     * @generated from protobuf field: optional sid.v1.projects.OAuthClient client = 4
+     */
+    client?: OAuthClient;
+    /**
+     * The protected-resource role, when the application has one.
+     *
+     * @generated from protobuf field: optional sid.v1.projects.ProtectedResource resource = 5
      */
-    type: ApplicationType;
+    resource?: ProtectedResource;
+    /**
+     * Stored revision of the application record; moves on with every change
+     * of its name.
+     *
+     * @generated from protobuf field: uint64 revision = 6
+     */
+    revision: bigint;
+    /**
+     * @generated from protobuf field: google.protobuf.Timestamp created_at = 7
+     */
+    createdAt?: Timestamp;
+    /**
+     * @generated from protobuf field: google.protobuf.Timestamp updated_at = 8
+     */
+    updatedAt?: Timestamp;
+    /**
+     * Set when the application is one of the installation's own integrations,
+     * which SID provisions and keeps; unset for an administrator's application.
+     * Its roles and access are shown like any other application's.
+     *
+     * @generated from protobuf field: sid.v1.projects.SystemIntegration system_integration = 9
+     */
+    systemIntegration: SystemIntegration;
+}
+/**
+ * The OAuth client role of an application: software that obtains tokens.
+ *
+ * @generated from protobuf message sid.v1.projects.OAuthClient
+ */
+export interface OAuthClient {
+    /**
+     * OAuth `client_id`, assigned by the server; unique within the installation.
+     *
+     * @generated from protobuf field: string client_id = 1
+     */
+    clientId: string;
+    /**
+     * Application (UUIDv7) whose client role this is.
+     *
+     * @generated from protobuf field: string application_id = 2
+     */
+    applicationId: string;
+    /**
+     * Project (UUID) of the application.
+     *
+     * @generated from protobuf field: string project_id = 3
+     */
+    projectId: string;
     /**
-     * OIDC configuration.
+     * Client name shown to users (RFC 7591 §2 `client_name`).
      *
-     * @generated from protobuf field: repeated string redirect_uris = 5
+     * @generated from protobuf field: string name = 4
+     */
+    name: string;
+    /**
+     * Kind of client software; decides whether it can hold a secret.
+     *
+     * @generated from protobuf field: sid.v1.projects.ApplicationType type = 5
+     */
+    type: ApplicationType;
+    /**
+     * @generated from protobuf field: repeated string redirect_uris = 6
      */
     redirectUris: string[];
     /**
-     * @generated from protobuf field: repeated string allowed_scopes = 6
+     * Scopes this client may request at all; access to a resource further
+     * limits them to what that access grants.
+     *
+     * @generated from protobuf field: repeated string allowed_scopes = 7
      */
     allowedScopes: string[];
     /**
-     * @generated from protobuf field: repeated string grant_types = 7
+     * @generated from protobuf field: repeated string grant_types = 8
      */
     grantTypes: string[];
     /**
-     * @generated from protobuf field: bool active = 8
+     * @generated from protobuf field: bool active = 9
      */
     active: boolean;
     /**
-     * @generated from protobuf field: google.protobuf.Timestamp created_at = 9
+     * @generated from protobuf field: google.protobuf.Timestamp created_at = 10
      */
     createdAt?: Timestamp;
     /**
-     * DCR fields (RFC 7591).
+     * How the client authenticates at the token endpoint (RFC 7591 §2).
      *
-     * @generated from protobuf field: sid.v1.projects.TokenEndpointAuthMethod token_endpoint_auth_method = 10
+     * @generated from protobuf field: sid.v1.projects.TokenEndpointAuthMethod token_endpoint_auth_method = 11
      */
     tokenEndpointAuthMethod: TokenEndpointAuthMethod;
     /**
-     * @generated from protobuf field: repeated string response_types = 11
+     * @generated from protobuf field: repeated string response_types = 12
      */
     responseTypes: string[];
     /**
-     * @generated from protobuf field: sid.v1.projects.SubjectType subject_type = 12
+     * @generated from protobuf field: sid.v1.projects.SubjectType subject_type = 13
      */
     subjectType: SubjectType;
     /**
-     * @generated from protobuf field: optional string sector_identifier_uri = 13
+     * @generated from protobuf field: optional string sector_identifier_uri = 14
      */
     sectorIdentifierUri?: string;
     /**
-     * @generated from protobuf field: repeated string contacts = 14
+     * @generated from protobuf field: repeated string contacts = 15
      */
     contacts: string[];
     /**
-     * @generated from protobuf field: google.protobuf.Timestamp client_id_issued_at = 15
+     * @generated from protobuf field: google.protobuf.Timestamp client_id_issued_at = 16
      */
     clientIdIssuedAt?: Timestamp;
     /**
-     * @generated from protobuf field: optional google.protobuf.Timestamp client_secret_expires_at = 16
+     * @generated from protobuf field: optional google.protobuf.Timestamp client_secret_expires_at = 17
      */
     clientSecretExpiresAt?: Timestamp;
     /**
-     * @generated from protobuf field: bool dynamically_registered = 17
+     * Registered through Dynamic Client Registration (RFC 7591).
+     *
+     * @generated from protobuf field: bool dynamically_registered = 18
      */
     dynamicallyRegistered: boolean;
     /**
-     * Organization this client belongs to. Used as the binding grouping
-     * key for pairwise sub derivation (org-model.md §Binding Grouping):
-     *   sub = HMAC(salt, profile_id || org_id || "sid-pairwise-sub-v1")
-     * All clients within the same org produce the same BindingId for a
-     * given profile — domain changes don't affect sub stability.
-     * Empty = no org association (legacy CE clients before org model).
+     * Recipient organization of this client (UUIDv7). A pairwise recipient's
+     * subject is the stored BindingId of the (Profile, organization) pair, so
+     * every client of one organization sees the same subject for a user and
+     * redirect domains do not change it. Assigned at registration.
      *
-     * @generated from protobuf field: optional string org_id = 18
+     * @generated from protobuf field: optional string org_id = 19
      */
     orgId?: string;
+    /**
+     * Exact OIDC issuer identifier this client is registered under, the
+     * canonical URL `https://<host>/i/<handle>`. Part of the connection details
+     * a relying party configures verbatim: it discovers endpoints at
+     * `<issuer>/.well-known/openid-configuration` and keys accounts by
+     * (issuer, sub). Assigned by the server at registration and never changed
+     * by an ordinary update; every client has one.
+     *
+     * @generated from protobuf field: string issuer = 20
+     */
+    issuer: string;
+    /**
+     * The protected resource (ProtectedResource.id, UUIDv7) a token is issued
+     * for when a token request names none (RFC 8707 §2). Effective only while
+     * the client has access to that resource. Without it, a request naming no
+     * resource is refused with `invalid_target`; no other audience is
+     * substituted.
+     *
+     * @generated from protobuf field: optional string default_resource_id = 21
+     */
+    defaultResourceId?: string;
+    /**
+     * Stored revision of the client role.
+     *
+     * @generated from protobuf field: uint64 revision = 22
+     */
+    revision: bigint;
+    /**
+     * The client's registered public signing keys (RFC 7591 §2 `jwks`), the
+     * JSON text of a JWK Set, when it has any. Public material only.
+     *
+     * @generated from protobuf field: optional string jwks = 23
+     */
+    jwks?: string;
+    /**
+     * Where the end-session endpoint may send the browser after logout (OIDC
+     * RP-Initiated Logout 1.0 §3.1): absolute URIs without a fragment, compared
+     * exactly. Empty means the endpoint never redirects for this client.
+     *
+     * @generated from protobuf field: repeated string post_logout_redirect_uris = 24
+     */
+    postLogoutRedirectUris: string[];
+}
+/**
+ * The protected-resource role of an application: an API or application at
+ * which access tokens are accepted and access is enforced.
+ *
+ * @generated from protobuf message sid.v1.projects.ProtectedResource
+ */
+export interface ProtectedResource {
+    /**
+     * Server-assigned resource identifier (UUIDv7), used to manage the resource
+     * and its access. Not the token audience.
+     *
+     * @generated from protobuf field: string id = 1
+     */
+    id: string;
+    /**
+     * Application (UUIDv7) holding this role; absent once the resource is
+     * retired with its application.
+     *
+     * @generated from protobuf field: optional string application_id = 2
+     */
+    applicationId?: string;
+    /**
+     * The resource indicator (RFC 8707 §2): an absolute URI without a fragment,
+     * in canonical form, e.g. `https://api.example.com/orders`. It is the `aud`
+     * of every access token issued for this resource and the `resource` value
+     * clients send. An identifier, not a URL SID fetches. Unique within its
+     * issuer for ever: a retired indicator is never given to another resource.
+     *
+     * @generated from protobuf field: string indicator = 3
+     */
+    indicator: string;
+    /**
+     * Exact OIDC issuer identifier whose tokens this resource accepts, the
+     * canonical URL `https://<host>/i/<handle>`. Fixed at registration.
+     *
+     * @generated from protobuf field: string issuer = 4
+     */
+    issuer: string;
+    /**
+     * Scopes this resource understands; access to it grants no others.
+     *
+     * @generated from protobuf field: repeated string scopes = 5
+     */
+    scopes: string[];
+    /**
+     * @generated from protobuf field: sid.v1.projects.ResourceState state = 6
+     */
+    state: ResourceState;
+    /**
+     * Stored revision of the resource role.
+     *
+     * @generated from protobuf field: uint64 revision = 7
+     */
+    revision: bigint;
+    /**
+     * @generated from protobuf field: google.protobuf.Timestamp created_at = 8
+     */
+    createdAt?: Timestamp;
+    /**
+     * @generated from protobuf field: google.protobuf.Timestamp updated_at = 9
+     */
+    updatedAt?: Timestamp;
+}
+/**
+ * Explicit permission for one client to obtain access tokens for one
+ * resource, limited to `scopes`. Project membership, a shared issuer or an
+ * equal subject grant no access by themselves.
+ *
+ * @generated from protobuf message sid.v1.projects.ResourceAccess
+ */
+export interface ResourceAccess {
+    /**
+     * Identifier (RFC 6749 §2.2) of the client given access: an OAuth client
+     * of an application, or a machine user requesting tokens for itself.
+     *
+     * @generated from protobuf field: string client_id = 1
+     */
+    clientId: string;
+    /**
+     * The resource (ProtectedResource.id, UUIDv7) it may obtain tokens for.
+     *
+     * @generated from protobuf field: string resource_id = 2
+     */
+    resourceId: string;
+    /**
+     * Scopes this access grants; always a subset of the resource's scopes.
+     *
+     * @generated from protobuf field: repeated string scopes = 3
+     */
+    scopes: string[];
+    /**
+     * @generated from protobuf field: google.protobuf.Timestamp created_at = 4
+     */
+    createdAt?: Timestamp;
 }
 /**
  * Initial Access Token constrains DCR registrations.
@@ -272,6 +490,90 @@ export interface DeleteProjectRequest {
 }
 // ── Application messages ──
 
+/**
+ * Settings of a new OAuth client role.
+ *
+ * @generated from protobuf message sid.v1.projects.ClientRoleSettings
+ */
+export interface ClientRoleSettings {
+    /**
+     * Kind of client software. Web and API clients get a secret; native and
+     * single-page clients are public and authenticate with PKCE alone.
+     * Unspecified is web.
+     *
+     * @generated from protobuf field: sid.v1.projects.ApplicationType type = 1
+     */
+    type: ApplicationType;
+    /**
+     * @generated from protobuf field: repeated string redirect_uris = 2
+     */
+    redirectUris: string[];
+    /**
+     * Scopes the client may request; empty is `openid profile email`.
+     *
+     * @generated from protobuf field: repeated string allowed_scopes = 3
+     */
+    allowedScopes: string[];
+    /**
+     * Grant types; empty is `authorization_code refresh_token`.
+     *
+     * @generated from protobuf field: repeated string grant_types = 4
+     */
+    grantTypes: string[];
+    /**
+     * The client's public signing keys, the JSON text of a JWK Set (RFC 7591 §2
+     * `jwks`; see RegisterClientRequest.jwks for the accepted keys). Given, a
+     * web or API client authenticates with `private_key_jwt` (RFC 7523 §2.2)
+     * and gets no secret: its private key never reaches SID. Refused for a
+     * native or single-page client, which is public.
+     *
+     * @generated from protobuf field: optional string jwks = 5
+     */
+    jwks?: string;
+    /**
+     * Post-logout redirect URIs (see OAuthClient.post_logout_redirect_uris),
+     * validated like redirect URIs for the client's type; an invalid one is
+     * INVALID_ARGUMENT, field `post_logout_redirect_uris`.
+     *
+     * @generated from protobuf field: repeated string post_logout_redirect_uris = 6
+     */
+    postLogoutRedirectUris: string[];
+}
+/**
+ * A list of URIs, set as a whole by an update.
+ *
+ * @generated from protobuf message sid.v1.projects.UriList
+ */
+export interface UriList {
+    /**
+     * The URIs; empty clears the list.
+     *
+     * @generated from protobuf field: repeated string uris = 1
+     */
+    uris: string[];
+}
+/**
+ * Settings of a new protected-resource role.
+ *
+ * @generated from protobuf message sid.v1.projects.ResourceRoleSettings
+ */
+export interface ResourceRoleSettings {
+    /**
+     * Resource indicator (RFC 8707 §2): an absolute URI without a fragment in
+     * canonical form. Refused (INVALID_ARGUMENT, field `indicator`) otherwise,
+     * with the canonical spelling in the message when that is the only fault;
+     * ALREADY_EXISTS when the issuer already has, or had, a resource with it.
+     *
+     * @generated from protobuf field: string indicator = 1
+     */
+    indicator: string;
+    /**
+     * Scopes the resource understands.
+     *
+     * @generated from protobuf field: repeated string scopes = 2
+     */
+    scopes: string[];
+}
 /**
  * @generated from protobuf message sid.v1.projects.CreateApplicationRequest
  */
@@ -285,31 +587,27 @@ export interface CreateApplicationRequest {
      */
     name: string;
     /**
-     * @generated from protobuf field: sid.v1.projects.ApplicationType type = 3
-     */
-    type: ApplicationType;
-    /**
-     * @generated from protobuf field: repeated string redirect_uris = 4
-     */
-    redirectUris: string[];
-    /**
-     * @generated from protobuf field: repeated string allowed_scopes = 5
+     * At least one role is required.
+     *
+     * @generated from protobuf field: optional sid.v1.projects.ClientRoleSettings client = 3
      */
-    allowedScopes: string[];
+    client?: ClientRoleSettings;
     /**
-     * @generated from protobuf field: repeated string grant_types = 6
+     * @generated from protobuf field: optional sid.v1.projects.ResourceRoleSettings resource = 4
      */
-    grantTypes: string[];
+    resource?: ResourceRoleSettings;
     /**
-     * Organization to associate this client with (for pairwise sub derivation).
-     * Empty = inherit from project's org (if any).
+     * Recipient organization (UUIDv7). Empty means the installation's
+     * organization; naming any other organization is refused.
      *
-     * @generated from protobuf field: optional string org_id = 7
+     * @generated from protobuf field: optional string org_id = 5
      */
     orgId?: string;
 }
 /**
- * Returns client_secret in plaintext (only on creation, never stored).
+ * The application, and the client secret when a client role that holds a
+ * secret was created. The secret is returned only here and never stored in
+ * plaintext.
  *
  * @generated from protobuf message sid.v1.projects.CreateApplicationResponse
  */
@@ -328,9 +626,9 @@ export interface CreateApplicationResponse {
  */
 export interface GetApplicationRequest {
     /**
-     * @generated from protobuf field: string client_id = 1
+     * @generated from protobuf field: string id = 1
      */
-    clientId: string;
+    id: string;
 }
 /**
  * @generated from protobuf message sid.v1.projects.ListApplicationsRequest
@@ -366,6 +664,43 @@ export interface ListApplicationsResponse {
  * @generated from protobuf message sid.v1.projects.UpdateApplicationRequest
  */
 export interface UpdateApplicationRequest {
+    /**
+     * @generated from protobuf field: string id = 1
+     */
+    id: string;
+    /**
+     * @generated from protobuf field: optional string name = 2
+     */
+    name?: string;
+}
+/**
+ * @generated from protobuf message sid.v1.projects.DeleteApplicationRequest
+ */
+export interface DeleteApplicationRequest {
+    /**
+     * @generated from protobuf field: string id = 1
+     */
+    id: string;
+}
+/**
+ * @generated from protobuf message sid.v1.projects.AddClientRoleRequest
+ */
+export interface AddClientRoleRequest {
+    /**
+     * Application (UUIDv7) without a client role yet; ALREADY_EXISTS otherwise.
+     *
+     * @generated from protobuf field: string application_id = 1
+     */
+    applicationId: string;
+    /**
+     * @generated from protobuf field: sid.v1.projects.ClientRoleSettings settings = 2
+     */
+    settings?: ClientRoleSettings;
+}
+/**
+ * @generated from protobuf message sid.v1.projects.UpdateClientRoleRequest
+ */
+export interface UpdateClientRoleRequest {
     /**
      * @generated from protobuf field: string client_id = 1
      */
@@ -391,72 +726,213 @@ export interface UpdateApplicationRequest {
      */
     active?: boolean;
     /**
-     * "public" or "pairwise". Changing from public→pairwise triggers
-     * 90-day dual-sub transition (sid_legacy_sub in tokens).
+     * OIDC subject type metadata. Only "public" is accepted: each issuer
+     * advertises `subject_types_supported: ["public"]` and SID's pairwise
+     * privacy comes from the recipient's BindingId, not from this value. Any
+     * other value is INVALID_ARGUMENT (ErrorInfo metadata `oauth_error` =
+     * `invalid_client_metadata`) and nothing is changed. Moving an application's
+     * users to another identifier is an explicit account migration, never an
+     * update.
      *
      * @generated from protobuf field: optional string subject_type = 7
      */
     subjectType?: string;
-}
-/**
- * @generated from protobuf message sid.v1.projects.DeleteApplicationRequest
- */
-export interface DeleteApplicationRequest {
     /**
-     * @generated from protobuf field: string client_id = 1
+     * The resource (ProtectedResource.id) tokens are for when a request names
+     * none. The client must already have access to it (INVALID_ARGUMENT,
+     * field `default_resource_id`, otherwise). An empty value removes the
+     * default.
+     *
+     * @generated from protobuf field: optional string default_resource_id = 8
      */
-    clientId: string;
+    defaultResourceId?: string;
+    /**
+     * Replaces the post-logout redirect URIs (see ClientRoleSettings); left out,
+     * they are unchanged.
+     *
+     * @generated from protobuf field: optional sid.v1.projects.UriList post_logout_redirect_uris = 9
+     */
+    postLogoutRedirectUris?: UriList;
 }
-// ── Role messages (AddRole/RemoveRole specific to ProjectService) ──
-
 /**
- * @generated from protobuf message sid.v1.projects.AddRoleRequest
+ * @generated from protobuf message sid.v1.projects.AddResourceRoleRequest
  */
-export interface AddRoleRequest {
+export interface AddResourceRoleRequest {
     /**
-     * @generated from protobuf field: string project_id = 1
+     * Application (UUIDv7) without a resource role yet; ALREADY_EXISTS otherwise.
+     *
+     * @generated from protobuf field: string application_id = 1
      */
-    projectId: string;
+    applicationId: string;
     /**
-     * @generated from protobuf field: string key = 2
+     * @generated from protobuf field: sid.v1.projects.ResourceRoleSettings settings = 2
      */
-    key: string;
+    settings?: ResourceRoleSettings;
+}
+/**
+ * A replacement list of scopes, set as a whole.
+ *
+ * @generated from protobuf message sid.v1.projects.ScopeList
+ */
+export interface ScopeList {
     /**
-     * @generated from protobuf field: string display_name = 3
+     * @generated from protobuf field: repeated string scopes = 1
      */
-    displayName: string;
+    scopes: string[];
+}
+/**
+ * @generated from protobuf message sid.v1.projects.UpdateResourceRoleRequest
+ */
+export interface UpdateResourceRoleRequest {
     /**
-     * @generated from protobuf field: optional string description = 4
+     * @generated from protobuf field: string resource_id = 1
      */
-    description?: string;
+    resourceId: string;
     /**
-     * @generated from protobuf field: optional string group = 5
+     * Replaces the scopes the resource understands. Access already granted
+     * keeps its scopes but grants only those the resource still understands.
+     *
+     * @generated from protobuf field: optional sid.v1.projects.ScopeList scopes = 2
      */
-    group?: string;
+    scopes?: ScopeList;
     /**
-     * @generated from protobuf field: repeated string permissions = 6
+     * ACTIVE or INACTIVE. A resource is retired only by removing its
+     * application; RETIRED here, or any change of a retired resource, is
+     * FAILED_PRECONDITION.
+     *
+     * @generated from protobuf field: optional sid.v1.projects.ResourceState state = 3
      */
-    permissions: string[];
+    state?: ResourceState;
 }
 /**
- * @generated from protobuf message sid.v1.projects.RemoveRoleRequest
+ * @generated from protobuf message sid.v1.projects.SetResourceAccessRequest
  */
-export interface RemoveRoleRequest {
+export interface SetResourceAccessRequest {
     /**
-     * @generated from protobuf field: string project_id = 1
+     * Identifier of the client to give access: an OAuth client, or a machine
+     * user (served by the installation organization's issuer). Unknown to both
+     * is NOT_FOUND.
+     *
+     * @generated from protobuf field: string client_id = 1
      */
-    projectId: string;
+    clientId: string;
     /**
-     * @generated from protobuf field: string role_id = 2
+     * The resource (ProtectedResource.id, UUIDv7).
+     *
+     * @generated from protobuf field: string resource_id = 2
      */
-    roleId: string;
+    resourceId: string;
+    /**
+     * Replaces the scopes of this access. Each must be a scope of the resource
+     * (INVALID_ARGUMENT otherwise). The client and the resource must belong to
+     * the same issuer (FAILED_PRECONDITION, ISSUER_MISMATCH), and a retired
+     * resource accepts no access (FAILED_PRECONDITION, RESOURCE_RETIRED).
+     *
+     * @generated from protobuf field: repeated string scopes = 3
+     */
+    scopes: string[];
 }
-// ── Dynamic Client Registration messages (RFC 7591/7592) ──
-
 /**
- * @generated from protobuf message sid.v1.projects.RegisterClientRequest
+ * @generated from protobuf message sid.v1.projects.RemoveResourceAccessRequest
  */
-export interface RegisterClientRequest {
+export interface RemoveResourceAccessRequest {
+    /**
+     * Identifier of the OAuth client or machine user losing access.
+     *
+     * @generated from protobuf field: string client_id = 1
+     */
+    clientId: string;
+    /**
+     * The resource (ProtectedResource.id, UUIDv7).
+     *
+     * @generated from protobuf field: string resource_id = 2
+     */
+    resourceId: string;
+}
+/**
+ * @generated from protobuf message sid.v1.projects.ListResourceAccessRequest
+ */
+export interface ListResourceAccessRequest {
+    /**
+     * Every access of one client, or every access to one resource.
+     *
+     * @generated from protobuf oneof: subject
+     */
+    subject: {
+        oneofKind: "clientId";
+        /**
+         * @generated from protobuf field: string client_id = 1
+         */
+        clientId: string;
+    } | {
+        oneofKind: "resourceId";
+        /**
+         * @generated from protobuf field: string resource_id = 2
+         */
+        resourceId: string;
+    } | {
+        oneofKind: undefined;
+    };
+}
+/**
+ * @generated from protobuf message sid.v1.projects.ListResourceAccessResponse
+ */
+export interface ListResourceAccessResponse {
+    /**
+     * @generated from protobuf field: repeated sid.v1.projects.ResourceAccess access = 1
+     */
+    access: ResourceAccess[];
+}
+// ── Role messages (AddRole/RemoveRole specific to ProjectService) ──
+
+/**
+ * @generated from protobuf message sid.v1.projects.AddRoleRequest
+ */
+export interface AddRoleRequest {
+    /**
+     * @generated from protobuf field: string project_id = 1
+     */
+    projectId: string;
+    /**
+     * @generated from protobuf field: string key = 2
+     */
+    key: string;
+    /**
+     * @generated from protobuf field: string display_name = 3
+     */
+    displayName: string;
+    /**
+     * @generated from protobuf field: optional string description = 4
+     */
+    description?: string;
+    /**
+     * @generated from protobuf field: optional string group = 5
+     */
+    group?: string;
+    /**
+     * @generated from protobuf field: repeated string permissions = 6
+     */
+    permissions: string[];
+}
+/**
+ * @generated from protobuf message sid.v1.projects.RemoveRoleRequest
+ */
+export interface RemoveRoleRequest {
+    /**
+     * @generated from protobuf field: string project_id = 1
+     */
+    projectId: string;
+    /**
+     * @generated from protobuf field: string role_id = 2
+     */
+    roleId: string;
+}
+// ── Dynamic Client Registration messages (RFC 7591/7592) ──
+
+/**
+ * @generated from protobuf message sid.v1.projects.RegisterClientRequest
+ */
+export interface RegisterClientRequest {
     /**
      * Bearer initial_access_token in gRPC metadata (authorization header).
      *
@@ -499,17 +975,45 @@ export interface RegisterClientRequest {
      * @generated from protobuf field: repeated string scope = 10
      */
     scope: string[];
+    /**
+     * Handle of the OIDC issuer the client registers under, the `<handle>` of
+     * `https://<host>/i/<handle>`. The client belongs to the organization this
+     * issuer serves, and its registration access token manages it only under
+     * this issuer. An unknown handle is NOT_FOUND (OIDC_ISSUER_NOT_FOUND).
+     *
+     * @generated from protobuf field: string issuer_handle = 11
+     */
+    issuerHandle: string;
+    /**
+     * The client's public signing keys (RFC 7591 §2 `jwks`), the JSON text of a
+     * JWK Set (RFC 7517 §5): Ed25519, P-256/P-384 or RSA (at least 2048 bits)
+     * public keys, each with a distinct `kid`, no private members. Required for
+     * `private_key_jwt`, whose token endpoint assertions they verify.
+     *
+     * @generated from protobuf field: optional string jwks = 12
+     */
+    jwks?: string;
+    /**
+     * Post-logout redirect URIs (OIDC RP-Initiated Logout 1.0 §3.1), validated
+     * like `redirect_uris` and against the initial access token's redirect
+     * patterns; refused as `invalid_client_metadata`.
+     *
+     * @generated from protobuf field: repeated string post_logout_redirect_uris = 13
+     */
+    postLogoutRedirectUris: string[];
 }
 /**
  * @generated from protobuf message sid.v1.projects.RegisterClientResponse
  */
 export interface RegisterClientResponse {
     /**
-     * @generated from protobuf field: sid.v1.projects.Application application = 1
+     * The registered client, the client role of a new application.
+     *
+     * @generated from protobuf field: sid.v1.projects.OAuthClient client = 1
      */
-    application?: Application;
+    client?: OAuthClient;
     /**
-     * Plaintext secret — only returned on registration. Never stored.
+     * Plaintext secret, returned only on registration. Never stored.
      *
      * @generated from protobuf field: optional string client_secret = 2
      */
@@ -531,9 +1035,21 @@ export interface GetRegisteredClientRequest {
      * @generated from protobuf field: string client_id = 1
      */
     clientId: string;
+    /**
+     * Handle of the issuer the client is registered under. A client of another
+     * issuer, or none, is refused exactly like an invalid registration access
+     * token (RFC 7592 §2.1).
+     *
+     * @generated from protobuf field: string issuer_handle = 2
+     */
+    issuerHandle: string;
 }
 /**
  * RFC 7592: client updates own registration. RAT in authorization header.
+ * The request is the client's whole metadata and replaces its registration
+ * (RFC 7592 §2.2): a field left out is removed, an absent authentication
+ * method is `client_secret_basic` (RFC 7591 §2), and the result is validated
+ * as a registration; a refused update changes nothing.
  *
  * @generated from protobuf message sid.v1.projects.UpdateRegisteredClientRequest
  */
@@ -578,6 +1094,36 @@ export interface UpdateRegisteredClientRequest {
      * @generated from protobuf field: repeated string scope = 10
      */
     scope: string[];
+    /**
+     * Handle of the issuer the client is registered under (see
+     * GetRegisteredClientRequest).
+     *
+     * @generated from protobuf field: string issuer_handle = 11
+     */
+    issuerHandle: string;
+    /**
+     * The client's current secret, when the client sends it back with its
+     * metadata. It must equal the issued secret (RFC 7592 §2.2); it never sets
+     * a new one.
+     *
+     * @generated from protobuf field: optional string client_secret = 12
+     */
+    clientSecret?: string;
+    /**
+     * The client's public signing keys (see RegisterClientRequest.jwks); left
+     * out, the client registers none. A rotation sends the next key beside the
+     * current one, then the next key alone.
+     *
+     * @generated from protobuf field: optional string jwks = 13
+     */
+    jwks?: string;
+    /**
+     * Post-logout redirect URIs (see RegisterClientRequest); left out, the
+     * client registers none.
+     *
+     * @generated from protobuf field: repeated string post_logout_redirect_uris = 14
+     */
+    postLogoutRedirectUris: string[];
 }
 /**
  * RFC 7592: client deletes own registration. RAT in authorization header.
@@ -589,6 +1135,13 @@ export interface DeleteRegisteredClientRequest {
      * @generated from protobuf field: string client_id = 1
      */
     clientId: string;
+    /**
+     * Handle of the issuer the client is registered under (see
+     * GetRegisteredClientRequest).
+     *
+     * @generated from protobuf field: string issuer_handle = 2
+     */
+    issuerHandle: string;
 }
 // ── Initial Access Token messages ──
 
@@ -624,7 +1177,7 @@ export interface CreateInitialAccessTokenRequest {
     expiresInSeconds: bigint;
 }
 /**
- * Returns plaintext token — only on creation.
+ * Returns the plaintext token, only on creation.
  *
  * @generated from protobuf message sid.v1.projects.CreateInitialAccessTokenResponse
  */
@@ -634,7 +1187,7 @@ export interface CreateInitialAccessTokenResponse {
      */
     token?: InitialAccessToken;
     /**
-     * Plaintext bearer token — never stored, never returned again.
+     * Plaintext bearer token: never stored, never returned again.
      *
      * @generated from protobuf field: string token_value = 2
      */
@@ -667,6 +1220,56 @@ export interface RevokeInitialAccessTokenRequest {
      */
     id: string;
 }
+/**
+ * An integration of the installation with itself, provisioned by SID.
+ *
+ * @generated from protobuf enum sid.v1.projects.SystemIntegration
+ */
+export enum SystemIntegration {
+    /**
+     * An administrator's application.
+     *
+     * @generated from protobuf enum value: SYSTEM_INTEGRATION_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * SID's own account UI: its confidential web client, the account API it
+     * calls and the client's explicit access to that API.
+     *
+     * @generated from protobuf enum value: SYSTEM_INTEGRATION_ACCOUNT = 1;
+     */
+    ACCOUNT = 1
+}
+/**
+ * Lifecycle of a protected resource.
+ *
+ * @generated from protobuf enum sid.v1.projects.ResourceState
+ */
+export enum ResourceState {
+    /**
+     * @generated from protobuf enum value: RESOURCE_STATE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * Tokens are issued for it and accepted by it.
+     *
+     * @generated from protobuf enum value: RESOURCE_STATE_ACTIVE = 1;
+     */
+    ACTIVE = 1,
+    /**
+     * Temporarily not a target; can be activated again.
+     *
+     * @generated from protobuf enum value: RESOURCE_STATE_INACTIVE = 2;
+     */
+    INACTIVE = 2,
+    /**
+     * Its application was removed. The indicator stays reserved; a retired
+     * resource never becomes active again.
+     *
+     * @generated from protobuf enum value: RESOURCE_STATE_RETIRED = 3;
+     */
+    RETIRED = 3
+}
 /**
  * @generated from protobuf enum sid.v1.projects.TokenEndpointAuthMethod
  */
@@ -710,6 +1313,8 @@ export enum SubjectType {
     PUBLIC = 2
 }
 /**
+ * Kind of client software.
+ *
  * @generated from protobuf enum sid.v1.projects.ApplicationType
  */
 export enum ApplicationType {
@@ -718,18 +1323,27 @@ export enum ApplicationType {
      */
     UNSPECIFIED = 0,
     /**
+     * Server-side web application; can hold a secret.
+     *
      * @generated from protobuf enum value: APPLICATION_TYPE_WEB = 1;
      */
     WEB = 1,
     /**
+     * Mobile or desktop application; public client.
+     *
      * @generated from protobuf enum value: APPLICATION_TYPE_NATIVE = 2;
      */
     NATIVE = 2,
     /**
+     * Machine client (client credentials); can hold a secret. An API that only
+     * receives requests needs no client role at all.
+     *
      * @generated from protobuf enum value: APPLICATION_TYPE_API = 3;
      */
     API = 3,
     /**
+     * Single-page application; public client.
+     *
      * @generated from protobuf enum value: APPLICATION_TYPE_SPA = 4;
      */
     SPA = 4
@@ -831,29 +1445,143 @@ export const Project = new Project$Type();
 class Application$Type extends MessageType<Application> {
     constructor() {
         super("sid.v1.projects.Application", [
-            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 2, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
             { no: 3, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "type", kind: "enum", T: () => ["sid.v1.projects.ApplicationType", ApplicationType, "APPLICATION_TYPE_"] },
-            { no: 5, name: "redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "allowed_scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 7, name: "grant_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 8, name: "active", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 9, name: "created_at", kind: "message", T: () => Timestamp },
-            { no: 10, name: "token_endpoint_auth_method", kind: "enum", T: () => ["sid.v1.projects.TokenEndpointAuthMethod", TokenEndpointAuthMethod, "TOKEN_ENDPOINT_AUTH_METHOD_"] },
-            { no: 11, name: "response_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 12, name: "subject_type", kind: "enum", T: () => ["sid.v1.projects.SubjectType", SubjectType, "SUBJECT_TYPE_"] },
-            { no: 13, name: "sector_identifier_uri", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 14, name: "contacts", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 15, name: "client_id_issued_at", kind: "message", T: () => Timestamp },
-            { no: 16, name: "client_secret_expires_at", kind: "message", T: () => Timestamp },
-            { no: 17, name: "dynamically_registered", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 18, name: "org_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 4, name: "client", kind: "message", T: () => OAuthClient },
+            { no: 5, name: "resource", kind: "message", T: () => ProtectedResource },
+            { no: 6, name: "revision", kind: "scalar", T: 4 /*ScalarType.UINT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 7, name: "created_at", kind: "message", T: () => Timestamp },
+            { no: 8, name: "updated_at", kind: "message", T: () => Timestamp },
+            { no: 9, name: "system_integration", kind: "enum", T: () => ["sid.v1.projects.SystemIntegration", SystemIntegration, "SYSTEM_INTEGRATION_"] }
         ]);
     }
     create(value?: PartialMessage<Application>): Application {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        message.projectId = "";
+        message.name = "";
+        message.revision = 0n;
+        message.systemIntegration = 0;
+        if (value !== undefined)
+            reflectionMergePartial<Application>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Application): Application {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                case /* string project_id */ 2:
+                    message.projectId = reader.string();
+                    break;
+                case /* string name */ 3:
+                    message.name = reader.string();
+                    break;
+                case /* optional sid.v1.projects.OAuthClient client */ 4:
+                    message.client = OAuthClient.internalBinaryRead(reader, reader.uint32(), options, message.client);
+                    break;
+                case /* optional sid.v1.projects.ProtectedResource resource */ 5:
+                    message.resource = ProtectedResource.internalBinaryRead(reader, reader.uint32(), options, message.resource);
+                    break;
+                case /* uint64 revision */ 6:
+                    message.revision = reader.uint64().toBigInt();
+                    break;
+                case /* google.protobuf.Timestamp created_at */ 7:
+                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                    break;
+                case /* google.protobuf.Timestamp updated_at */ 8:
+                    message.updatedAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.updatedAt);
+                    break;
+                case /* sid.v1.projects.SystemIntegration system_integration */ 9:
+                    message.systemIntegration = reader.int32();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: Application, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        /* string project_id = 2; */
+        if (message.projectId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.projectId);
+        /* string name = 3; */
+        if (message.name !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.name);
+        /* optional sid.v1.projects.OAuthClient client = 4; */
+        if (message.client)
+            OAuthClient.internalBinaryWrite(message.client, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
+        /* optional sid.v1.projects.ProtectedResource resource = 5; */
+        if (message.resource)
+            ProtectedResource.internalBinaryWrite(message.resource, writer.tag(5, WireType.LengthDelimited).fork(), options).join();
+        /* uint64 revision = 6; */
+        if (message.revision !== 0n)
+            writer.tag(6, WireType.Varint).uint64(message.revision);
+        /* google.protobuf.Timestamp created_at = 7; */
+        if (message.createdAt)
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
+        /* google.protobuf.Timestamp updated_at = 8; */
+        if (message.updatedAt)
+            Timestamp.internalBinaryWrite(message.updatedAt, writer.tag(8, WireType.LengthDelimited).fork(), options).join();
+        /* sid.v1.projects.SystemIntegration system_integration = 9; */
+        if (message.systemIntegration !== 0)
+            writer.tag(9, WireType.Varint).int32(message.systemIntegration);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.Application
+ */
+export const Application = new Application$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class OAuthClient$Type extends MessageType<OAuthClient> {
+    constructor() {
+        super("sid.v1.projects.OAuthClient", [
+            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "application_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "type", kind: "enum", T: () => ["sid.v1.projects.ApplicationType", ApplicationType, "APPLICATION_TYPE_"] },
+            { no: 6, name: "redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 7, name: "allowed_scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 8, name: "grant_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 9, name: "active", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 10, name: "created_at", kind: "message", T: () => Timestamp },
+            { no: 11, name: "token_endpoint_auth_method", kind: "enum", T: () => ["sid.v1.projects.TokenEndpointAuthMethod", TokenEndpointAuthMethod, "TOKEN_ENDPOINT_AUTH_METHOD_"] },
+            { no: 12, name: "response_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 13, name: "subject_type", kind: "enum", T: () => ["sid.v1.projects.SubjectType", SubjectType, "SUBJECT_TYPE_"] },
+            { no: 14, name: "sector_identifier_uri", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 15, name: "contacts", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 16, name: "client_id_issued_at", kind: "message", T: () => Timestamp },
+            { no: 17, name: "client_secret_expires_at", kind: "message", T: () => Timestamp },
+            { no: 18, name: "dynamically_registered", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 19, name: "org_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 20, name: "issuer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 21, name: "default_resource_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 22, name: "revision", kind: "scalar", T: 4 /*ScalarType.UINT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 23, name: "jwks", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 24, name: "post_logout_redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<OAuthClient>): OAuthClient {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.clientId = "";
+        message.applicationId = "";
         message.projectId = "";
         message.name = "";
         message.type = 0;
@@ -866,11 +1594,14 @@ class Application$Type extends MessageType<Application> {
         message.subjectType = 0;
         message.contacts = [];
         message.dynamicallyRegistered = false;
+        message.issuer = "";
+        message.revision = 0n;
+        message.postLogoutRedirectUris = [];
         if (value !== undefined)
-            reflectionMergePartial<Application>(this, message, value);
+            reflectionMergePartial<OAuthClient>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: Application): Application {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: OAuthClient): OAuthClient {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
@@ -878,57 +1609,75 @@ class Application$Type extends MessageType<Application> {
                 case /* string client_id */ 1:
                     message.clientId = reader.string();
                     break;
-                case /* string project_id */ 2:
+                case /* string application_id */ 2:
+                    message.applicationId = reader.string();
+                    break;
+                case /* string project_id */ 3:
                     message.projectId = reader.string();
                     break;
-                case /* string name */ 3:
+                case /* string name */ 4:
                     message.name = reader.string();
                     break;
-                case /* sid.v1.projects.ApplicationType type */ 4:
+                case /* sid.v1.projects.ApplicationType type */ 5:
                     message.type = reader.int32();
                     break;
-                case /* repeated string redirect_uris */ 5:
+                case /* repeated string redirect_uris */ 6:
                     message.redirectUris.push(reader.string());
                     break;
-                case /* repeated string allowed_scopes */ 6:
+                case /* repeated string allowed_scopes */ 7:
                     message.allowedScopes.push(reader.string());
                     break;
-                case /* repeated string grant_types */ 7:
+                case /* repeated string grant_types */ 8:
                     message.grantTypes.push(reader.string());
                     break;
-                case /* bool active */ 8:
+                case /* bool active */ 9:
                     message.active = reader.bool();
                     break;
-                case /* google.protobuf.Timestamp created_at */ 9:
+                case /* google.protobuf.Timestamp created_at */ 10:
                     message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
                     break;
-                case /* sid.v1.projects.TokenEndpointAuthMethod token_endpoint_auth_method */ 10:
+                case /* sid.v1.projects.TokenEndpointAuthMethod token_endpoint_auth_method */ 11:
                     message.tokenEndpointAuthMethod = reader.int32();
                     break;
-                case /* repeated string response_types */ 11:
+                case /* repeated string response_types */ 12:
                     message.responseTypes.push(reader.string());
                     break;
-                case /* sid.v1.projects.SubjectType subject_type */ 12:
+                case /* sid.v1.projects.SubjectType subject_type */ 13:
                     message.subjectType = reader.int32();
                     break;
-                case /* optional string sector_identifier_uri */ 13:
+                case /* optional string sector_identifier_uri */ 14:
                     message.sectorIdentifierUri = reader.string();
                     break;
-                case /* repeated string contacts */ 14:
+                case /* repeated string contacts */ 15:
                     message.contacts.push(reader.string());
                     break;
-                case /* google.protobuf.Timestamp client_id_issued_at */ 15:
+                case /* google.protobuf.Timestamp client_id_issued_at */ 16:
                     message.clientIdIssuedAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.clientIdIssuedAt);
                     break;
-                case /* optional google.protobuf.Timestamp client_secret_expires_at */ 16:
+                case /* optional google.protobuf.Timestamp client_secret_expires_at */ 17:
                     message.clientSecretExpiresAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.clientSecretExpiresAt);
                     break;
-                case /* bool dynamically_registered */ 17:
+                case /* bool dynamically_registered */ 18:
                     message.dynamicallyRegistered = reader.bool();
                     break;
-                case /* optional string org_id */ 18:
+                case /* optional string org_id */ 19:
                     message.orgId = reader.string();
                     break;
+                case /* string issuer */ 20:
+                    message.issuer = reader.string();
+                    break;
+                case /* optional string default_resource_id */ 21:
+                    message.defaultResourceId = reader.string();
+                    break;
+                case /* uint64 revision */ 22:
+                    message.revision = reader.uint64().toBigInt();
+                    break;
+                case /* optional string jwks */ 23:
+                    message.jwks = reader.string();
+                    break;
+                case /* repeated string post_logout_redirect_uris */ 24:
+                    message.postLogoutRedirectUris.push(reader.string());
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -940,61 +1689,79 @@ class Application$Type extends MessageType<Application> {
         }
         return message;
     }
-    internalBinaryWrite(message: Application, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+    internalBinaryWrite(message: OAuthClient, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
         /* string client_id = 1; */
         if (message.clientId !== "")
             writer.tag(1, WireType.LengthDelimited).string(message.clientId);
-        /* string project_id = 2; */
+        /* string application_id = 2; */
+        if (message.applicationId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.applicationId);
+        /* string project_id = 3; */
         if (message.projectId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.projectId);
-        /* string name = 3; */
+            writer.tag(3, WireType.LengthDelimited).string(message.projectId);
+        /* string name = 4; */
         if (message.name !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.name);
-        /* sid.v1.projects.ApplicationType type = 4; */
+            writer.tag(4, WireType.LengthDelimited).string(message.name);
+        /* sid.v1.projects.ApplicationType type = 5; */
         if (message.type !== 0)
-            writer.tag(4, WireType.Varint).int32(message.type);
-        /* repeated string redirect_uris = 5; */
+            writer.tag(5, WireType.Varint).int32(message.type);
+        /* repeated string redirect_uris = 6; */
         for (let i = 0; i < message.redirectUris.length; i++)
-            writer.tag(5, WireType.LengthDelimited).string(message.redirectUris[i]);
-        /* repeated string allowed_scopes = 6; */
+            writer.tag(6, WireType.LengthDelimited).string(message.redirectUris[i]);
+        /* repeated string allowed_scopes = 7; */
         for (let i = 0; i < message.allowedScopes.length; i++)
-            writer.tag(6, WireType.LengthDelimited).string(message.allowedScopes[i]);
-        /* repeated string grant_types = 7; */
+            writer.tag(7, WireType.LengthDelimited).string(message.allowedScopes[i]);
+        /* repeated string grant_types = 8; */
         for (let i = 0; i < message.grantTypes.length; i++)
-            writer.tag(7, WireType.LengthDelimited).string(message.grantTypes[i]);
-        /* bool active = 8; */
+            writer.tag(8, WireType.LengthDelimited).string(message.grantTypes[i]);
+        /* bool active = 9; */
         if (message.active !== false)
-            writer.tag(8, WireType.Varint).bool(message.active);
-        /* google.protobuf.Timestamp created_at = 9; */
+            writer.tag(9, WireType.Varint).bool(message.active);
+        /* google.protobuf.Timestamp created_at = 10; */
         if (message.createdAt)
-            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
-        /* sid.v1.projects.TokenEndpointAuthMethod token_endpoint_auth_method = 10; */
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(10, WireType.LengthDelimited).fork(), options).join();
+        /* sid.v1.projects.TokenEndpointAuthMethod token_endpoint_auth_method = 11; */
         if (message.tokenEndpointAuthMethod !== 0)
-            writer.tag(10, WireType.Varint).int32(message.tokenEndpointAuthMethod);
-        /* repeated string response_types = 11; */
+            writer.tag(11, WireType.Varint).int32(message.tokenEndpointAuthMethod);
+        /* repeated string response_types = 12; */
         for (let i = 0; i < message.responseTypes.length; i++)
-            writer.tag(11, WireType.LengthDelimited).string(message.responseTypes[i]);
-        /* sid.v1.projects.SubjectType subject_type = 12; */
+            writer.tag(12, WireType.LengthDelimited).string(message.responseTypes[i]);
+        /* sid.v1.projects.SubjectType subject_type = 13; */
         if (message.subjectType !== 0)
-            writer.tag(12, WireType.Varint).int32(message.subjectType);
-        /* optional string sector_identifier_uri = 13; */
+            writer.tag(13, WireType.Varint).int32(message.subjectType);
+        /* optional string sector_identifier_uri = 14; */
         if (message.sectorIdentifierUri !== undefined)
-            writer.tag(13, WireType.LengthDelimited).string(message.sectorIdentifierUri);
-        /* repeated string contacts = 14; */
+            writer.tag(14, WireType.LengthDelimited).string(message.sectorIdentifierUri);
+        /* repeated string contacts = 15; */
         for (let i = 0; i < message.contacts.length; i++)
-            writer.tag(14, WireType.LengthDelimited).string(message.contacts[i]);
-        /* google.protobuf.Timestamp client_id_issued_at = 15; */
+            writer.tag(15, WireType.LengthDelimited).string(message.contacts[i]);
+        /* google.protobuf.Timestamp client_id_issued_at = 16; */
         if (message.clientIdIssuedAt)
-            Timestamp.internalBinaryWrite(message.clientIdIssuedAt, writer.tag(15, WireType.LengthDelimited).fork(), options).join();
-        /* optional google.protobuf.Timestamp client_secret_expires_at = 16; */
+            Timestamp.internalBinaryWrite(message.clientIdIssuedAt, writer.tag(16, WireType.LengthDelimited).fork(), options).join();
+        /* optional google.protobuf.Timestamp client_secret_expires_at = 17; */
         if (message.clientSecretExpiresAt)
-            Timestamp.internalBinaryWrite(message.clientSecretExpiresAt, writer.tag(16, WireType.LengthDelimited).fork(), options).join();
-        /* bool dynamically_registered = 17; */
+            Timestamp.internalBinaryWrite(message.clientSecretExpiresAt, writer.tag(17, WireType.LengthDelimited).fork(), options).join();
+        /* bool dynamically_registered = 18; */
         if (message.dynamicallyRegistered !== false)
-            writer.tag(17, WireType.Varint).bool(message.dynamicallyRegistered);
-        /* optional string org_id = 18; */
+            writer.tag(18, WireType.Varint).bool(message.dynamicallyRegistered);
+        /* optional string org_id = 19; */
         if (message.orgId !== undefined)
-            writer.tag(18, WireType.LengthDelimited).string(message.orgId);
+            writer.tag(19, WireType.LengthDelimited).string(message.orgId);
+        /* string issuer = 20; */
+        if (message.issuer !== "")
+            writer.tag(20, WireType.LengthDelimited).string(message.issuer);
+        /* optional string default_resource_id = 21; */
+        if (message.defaultResourceId !== undefined)
+            writer.tag(21, WireType.LengthDelimited).string(message.defaultResourceId);
+        /* uint64 revision = 22; */
+        if (message.revision !== 0n)
+            writer.tag(22, WireType.Varint).uint64(message.revision);
+        /* optional string jwks = 23; */
+        if (message.jwks !== undefined)
+            writer.tag(23, WireType.LengthDelimited).string(message.jwks);
+        /* repeated string post_logout_redirect_uris = 24; */
+        for (let i = 0; i < message.postLogoutRedirectUris.length; i++)
+            writer.tag(24, WireType.LengthDelimited).string(message.postLogoutRedirectUris[i]);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1002,42 +1769,37 @@ class Application$Type extends MessageType<Application> {
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.projects.Application
+ * @generated MessageType for protobuf message sid.v1.projects.OAuthClient
  */
-export const Application = new Application$Type();
+export const OAuthClient = new OAuthClient$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class InitialAccessToken$Type extends MessageType<InitialAccessToken> {
+class ProtectedResource$Type extends MessageType<ProtectedResource> {
     constructor() {
-        super("sid.v1.projects.InitialAccessToken", [
+        super("sid.v1.projects.ProtectedResource", [
             { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "max_clients", kind: "scalar", T: 13 /*ScalarType.UINT32*/ },
-            { no: 4, name: "clients_registered", kind: "scalar", T: 13 /*ScalarType.UINT32*/ },
-            { no: 5, name: "allowed_scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "allowed_grant_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 7, name: "allowed_redirect_patterns", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 8, name: "expires_at", kind: "message", T: () => Timestamp },
-            { no: 9, name: "created_at", kind: "message", T: () => Timestamp },
-            { no: 10, name: "created_by", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 11, name: "revoked", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+            { no: 2, name: "application_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "indicator", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "issuer", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "state", kind: "enum", T: () => ["sid.v1.projects.ResourceState", ResourceState, "RESOURCE_STATE_"] },
+            { no: 7, name: "revision", kind: "scalar", T: 4 /*ScalarType.UINT64*/, L: 0 /*LongType.BIGINT*/ },
+            { no: 8, name: "created_at", kind: "message", T: () => Timestamp },
+            { no: 9, name: "updated_at", kind: "message", T: () => Timestamp }
         ]);
     }
-    create(value?: PartialMessage<InitialAccessToken>): InitialAccessToken {
+    create(value?: PartialMessage<ProtectedResource>): ProtectedResource {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.id = "";
-        message.projectId = "";
-        message.maxClients = 0;
-        message.clientsRegistered = 0;
-        message.allowedScopes = [];
-        message.allowedGrantTypes = [];
-        message.allowedRedirectPatterns = [];
-        message.createdBy = "";
-        message.revoked = false;
+        message.indicator = "";
+        message.issuer = "";
+        message.scopes = [];
+        message.state = 0;
+        message.revision = 0n;
         if (value !== undefined)
-            reflectionMergePartial<InitialAccessToken>(this, message, value);
+            reflectionMergePartial<ProtectedResource>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: InitialAccessToken): InitialAccessToken {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ProtectedResource): ProtectedResource {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
@@ -1045,20 +1807,203 @@ class InitialAccessToken$Type extends MessageType<InitialAccessToken> {
                 case /* string id */ 1:
                     message.id = reader.string();
                     break;
-                case /* string project_id */ 2:
-                    message.projectId = reader.string();
+                case /* optional string application_id */ 2:
+                    message.applicationId = reader.string();
                     break;
-                case /* uint32 max_clients */ 3:
-                    message.maxClients = reader.uint32();
+                case /* string indicator */ 3:
+                    message.indicator = reader.string();
                     break;
-                case /* uint32 clients_registered */ 4:
-                    message.clientsRegistered = reader.uint32();
+                case /* string issuer */ 4:
+                    message.issuer = reader.string();
                     break;
-                case /* repeated string allowed_scopes */ 5:
-                    message.allowedScopes.push(reader.string());
+                case /* repeated string scopes */ 5:
+                    message.scopes.push(reader.string());
                     break;
-                case /* repeated string allowed_grant_types */ 6:
-                    message.allowedGrantTypes.push(reader.string());
+                case /* sid.v1.projects.ResourceState state */ 6:
+                    message.state = reader.int32();
+                    break;
+                case /* uint64 revision */ 7:
+                    message.revision = reader.uint64().toBigInt();
+                    break;
+                case /* google.protobuf.Timestamp created_at */ 8:
+                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                    break;
+                case /* google.protobuf.Timestamp updated_at */ 9:
+                    message.updatedAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.updatedAt);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ProtectedResource, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        /* optional string application_id = 2; */
+        if (message.applicationId !== undefined)
+            writer.tag(2, WireType.LengthDelimited).string(message.applicationId);
+        /* string indicator = 3; */
+        if (message.indicator !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.indicator);
+        /* string issuer = 4; */
+        if (message.issuer !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.issuer);
+        /* repeated string scopes = 5; */
+        for (let i = 0; i < message.scopes.length; i++)
+            writer.tag(5, WireType.LengthDelimited).string(message.scopes[i]);
+        /* sid.v1.projects.ResourceState state = 6; */
+        if (message.state !== 0)
+            writer.tag(6, WireType.Varint).int32(message.state);
+        /* uint64 revision = 7; */
+        if (message.revision !== 0n)
+            writer.tag(7, WireType.Varint).uint64(message.revision);
+        /* google.protobuf.Timestamp created_at = 8; */
+        if (message.createdAt)
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(8, WireType.LengthDelimited).fork(), options).join();
+        /* google.protobuf.Timestamp updated_at = 9; */
+        if (message.updatedAt)
+            Timestamp.internalBinaryWrite(message.updatedAt, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.ProtectedResource
+ */
+export const ProtectedResource = new ProtectedResource$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ResourceAccess$Type extends MessageType<ResourceAccess> {
+    constructor() {
+        super("sid.v1.projects.ResourceAccess", [
+            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "resource_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "created_at", kind: "message", T: () => Timestamp }
+        ]);
+    }
+    create(value?: PartialMessage<ResourceAccess>): ResourceAccess {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.clientId = "";
+        message.resourceId = "";
+        message.scopes = [];
+        if (value !== undefined)
+            reflectionMergePartial<ResourceAccess>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ResourceAccess): ResourceAccess {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string client_id */ 1:
+                    message.clientId = reader.string();
+                    break;
+                case /* string resource_id */ 2:
+                    message.resourceId = reader.string();
+                    break;
+                case /* repeated string scopes */ 3:
+                    message.scopes.push(reader.string());
+                    break;
+                case /* google.protobuf.Timestamp created_at */ 4:
+                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ResourceAccess, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string client_id = 1; */
+        if (message.clientId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.clientId);
+        /* string resource_id = 2; */
+        if (message.resourceId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.resourceId);
+        /* repeated string scopes = 3; */
+        for (let i = 0; i < message.scopes.length; i++)
+            writer.tag(3, WireType.LengthDelimited).string(message.scopes[i]);
+        /* google.protobuf.Timestamp created_at = 4; */
+        if (message.createdAt)
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.ResourceAccess
+ */
+export const ResourceAccess = new ResourceAccess$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class InitialAccessToken$Type extends MessageType<InitialAccessToken> {
+    constructor() {
+        super("sid.v1.projects.InitialAccessToken", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "max_clients", kind: "scalar", T: 13 /*ScalarType.UINT32*/ },
+            { no: 4, name: "clients_registered", kind: "scalar", T: 13 /*ScalarType.UINT32*/ },
+            { no: 5, name: "allowed_scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "allowed_grant_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 7, name: "allowed_redirect_patterns", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 8, name: "expires_at", kind: "message", T: () => Timestamp },
+            { no: 9, name: "created_at", kind: "message", T: () => Timestamp },
+            { no: 10, name: "created_by", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 11, name: "revoked", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+        ]);
+    }
+    create(value?: PartialMessage<InitialAccessToken>): InitialAccessToken {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        message.projectId = "";
+        message.maxClients = 0;
+        message.clientsRegistered = 0;
+        message.allowedScopes = [];
+        message.allowedGrantTypes = [];
+        message.allowedRedirectPatterns = [];
+        message.createdBy = "";
+        message.revoked = false;
+        if (value !== undefined)
+            reflectionMergePartial<InitialAccessToken>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: InitialAccessToken): InitialAccessToken {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                case /* string project_id */ 2:
+                    message.projectId = reader.string();
+                    break;
+                case /* uint32 max_clients */ 3:
+                    message.maxClients = reader.uint32();
+                    break;
+                case /* uint32 clients_registered */ 4:
+                    message.clientsRegistered = reader.uint32();
+                    break;
+                case /* repeated string allowed_scopes */ 5:
+                    message.allowedScopes.push(reader.string());
+                    break;
+                case /* repeated string allowed_grant_types */ 6:
+                    message.allowedGrantTypes.push(reader.string());
                     break;
                 case /* repeated string allowed_redirect_patterns */ 7:
                     message.allowedRedirectPatterns.push(reader.string());
@@ -1459,55 +2404,699 @@ class DeleteProjectRequest$Type extends MessageType<DeleteProjectRequest> {
  */
 export const DeleteProjectRequest = new DeleteProjectRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class CreateApplicationRequest$Type extends MessageType<CreateApplicationRequest> {
+class ClientRoleSettings$Type extends MessageType<ClientRoleSettings> {
     constructor() {
-        super("sid.v1.projects.CreateApplicationRequest", [
-            { no: 1, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "type", kind: "enum", T: () => ["sid.v1.projects.ApplicationType", ApplicationType, "APPLICATION_TYPE_"] },
-            { no: 4, name: "redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "allowed_scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "grant_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 7, name: "org_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+        super("sid.v1.projects.ClientRoleSettings", [
+            { no: 1, name: "type", kind: "enum", T: () => ["sid.v1.projects.ApplicationType", ApplicationType, "APPLICATION_TYPE_"] },
+            { no: 2, name: "redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "allowed_scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "grant_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "jwks", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "post_logout_redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<CreateApplicationRequest>): CreateApplicationRequest {
+    create(value?: PartialMessage<ClientRoleSettings>): ClientRoleSettings {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.projectId = "";
-        message.name = "";
         message.type = 0;
         message.redirectUris = [];
         message.allowedScopes = [];
         message.grantTypes = [];
+        message.postLogoutRedirectUris = [];
         if (value !== undefined)
-            reflectionMergePartial<CreateApplicationRequest>(this, message, value);
+            reflectionMergePartial<ClientRoleSettings>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateApplicationRequest): CreateApplicationRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ClientRoleSettings): ClientRoleSettings {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string project_id */ 1:
-                    message.projectId = reader.string();
+                case /* sid.v1.projects.ApplicationType type */ 1:
+                    message.type = reader.int32();
+                    break;
+                case /* repeated string redirect_uris */ 2:
+                    message.redirectUris.push(reader.string());
+                    break;
+                case /* repeated string allowed_scopes */ 3:
+                    message.allowedScopes.push(reader.string());
+                    break;
+                case /* repeated string grant_types */ 4:
+                    message.grantTypes.push(reader.string());
+                    break;
+                case /* optional string jwks */ 5:
+                    message.jwks = reader.string();
+                    break;
+                case /* repeated string post_logout_redirect_uris */ 6:
+                    message.postLogoutRedirectUris.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ClientRoleSettings, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* sid.v1.projects.ApplicationType type = 1; */
+        if (message.type !== 0)
+            writer.tag(1, WireType.Varint).int32(message.type);
+        /* repeated string redirect_uris = 2; */
+        for (let i = 0; i < message.redirectUris.length; i++)
+            writer.tag(2, WireType.LengthDelimited).string(message.redirectUris[i]);
+        /* repeated string allowed_scopes = 3; */
+        for (let i = 0; i < message.allowedScopes.length; i++)
+            writer.tag(3, WireType.LengthDelimited).string(message.allowedScopes[i]);
+        /* repeated string grant_types = 4; */
+        for (let i = 0; i < message.grantTypes.length; i++)
+            writer.tag(4, WireType.LengthDelimited).string(message.grantTypes[i]);
+        /* optional string jwks = 5; */
+        if (message.jwks !== undefined)
+            writer.tag(5, WireType.LengthDelimited).string(message.jwks);
+        /* repeated string post_logout_redirect_uris = 6; */
+        for (let i = 0; i < message.postLogoutRedirectUris.length; i++)
+            writer.tag(6, WireType.LengthDelimited).string(message.postLogoutRedirectUris[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.ClientRoleSettings
+ */
+export const ClientRoleSettings = new ClientRoleSettings$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UriList$Type extends MessageType<UriList> {
+    constructor() {
+        super("sid.v1.projects.UriList", [
+            { no: 1, name: "uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<UriList>): UriList {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.uris = [];
+        if (value !== undefined)
+            reflectionMergePartial<UriList>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UriList): UriList {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated string uris */ 1:
+                    message.uris.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UriList, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated string uris = 1; */
+        for (let i = 0; i < message.uris.length; i++)
+            writer.tag(1, WireType.LengthDelimited).string(message.uris[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.UriList
+ */
+export const UriList = new UriList$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ResourceRoleSettings$Type extends MessageType<ResourceRoleSettings> {
+    constructor() {
+        super("sid.v1.projects.ResourceRoleSettings", [
+            { no: 1, name: "indicator", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ResourceRoleSettings>): ResourceRoleSettings {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.indicator = "";
+        message.scopes = [];
+        if (value !== undefined)
+            reflectionMergePartial<ResourceRoleSettings>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ResourceRoleSettings): ResourceRoleSettings {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string indicator */ 1:
+                    message.indicator = reader.string();
+                    break;
+                case /* repeated string scopes */ 2:
+                    message.scopes.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ResourceRoleSettings, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string indicator = 1; */
+        if (message.indicator !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.indicator);
+        /* repeated string scopes = 2; */
+        for (let i = 0; i < message.scopes.length; i++)
+            writer.tag(2, WireType.LengthDelimited).string(message.scopes[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.ResourceRoleSettings
+ */
+export const ResourceRoleSettings = new ResourceRoleSettings$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class CreateApplicationRequest$Type extends MessageType<CreateApplicationRequest> {
+    constructor() {
+        super("sid.v1.projects.CreateApplicationRequest", [
+            { no: 1, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "client", kind: "message", T: () => ClientRoleSettings },
+            { no: 4, name: "resource", kind: "message", T: () => ResourceRoleSettings },
+            { no: 5, name: "org_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<CreateApplicationRequest>): CreateApplicationRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.projectId = "";
+        message.name = "";
+        if (value !== undefined)
+            reflectionMergePartial<CreateApplicationRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateApplicationRequest): CreateApplicationRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string project_id */ 1:
+                    message.projectId = reader.string();
+                    break;
+                case /* string name */ 2:
+                    message.name = reader.string();
+                    break;
+                case /* optional sid.v1.projects.ClientRoleSettings client */ 3:
+                    message.client = ClientRoleSettings.internalBinaryRead(reader, reader.uint32(), options, message.client);
+                    break;
+                case /* optional sid.v1.projects.ResourceRoleSettings resource */ 4:
+                    message.resource = ResourceRoleSettings.internalBinaryRead(reader, reader.uint32(), options, message.resource);
+                    break;
+                case /* optional string org_id */ 5:
+                    message.orgId = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: CreateApplicationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string project_id = 1; */
+        if (message.projectId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.projectId);
+        /* string name = 2; */
+        if (message.name !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.name);
+        /* optional sid.v1.projects.ClientRoleSettings client = 3; */
+        if (message.client)
+            ClientRoleSettings.internalBinaryWrite(message.client, writer.tag(3, WireType.LengthDelimited).fork(), options).join();
+        /* optional sid.v1.projects.ResourceRoleSettings resource = 4; */
+        if (message.resource)
+            ResourceRoleSettings.internalBinaryWrite(message.resource, writer.tag(4, WireType.LengthDelimited).fork(), options).join();
+        /* optional string org_id = 5; */
+        if (message.orgId !== undefined)
+            writer.tag(5, WireType.LengthDelimited).string(message.orgId);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.CreateApplicationRequest
+ */
+export const CreateApplicationRequest = new CreateApplicationRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class CreateApplicationResponse$Type extends MessageType<CreateApplicationResponse> {
+    constructor() {
+        super("sid.v1.projects.CreateApplicationResponse", [
+            { no: 1, name: "application", kind: "message", T: () => Application },
+            { no: 2, name: "client_secret", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<CreateApplicationResponse>): CreateApplicationResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.clientSecret = "";
+        if (value !== undefined)
+            reflectionMergePartial<CreateApplicationResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateApplicationResponse): CreateApplicationResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* sid.v1.projects.Application application */ 1:
+                    message.application = Application.internalBinaryRead(reader, reader.uint32(), options, message.application);
+                    break;
+                case /* string client_secret */ 2:
+                    message.clientSecret = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: CreateApplicationResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* sid.v1.projects.Application application = 1; */
+        if (message.application)
+            Application.internalBinaryWrite(message.application, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string client_secret = 2; */
+        if (message.clientSecret !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.clientSecret);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.CreateApplicationResponse
+ */
+export const CreateApplicationResponse = new CreateApplicationResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetApplicationRequest$Type extends MessageType<GetApplicationRequest> {
+    constructor() {
+        super("sid.v1.projects.GetApplicationRequest", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetApplicationRequest>): GetApplicationRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        if (value !== undefined)
+            reflectionMergePartial<GetApplicationRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetApplicationRequest): GetApplicationRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetApplicationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.GetApplicationRequest
+ */
+export const GetApplicationRequest = new GetApplicationRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListApplicationsRequest$Type extends MessageType<ListApplicationsRequest> {
+    constructor() {
+        super("sid.v1.projects.ListApplicationsRequest", [
+            { no: 1, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
+            { no: 3, name: "page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ListApplicationsRequest>): ListApplicationsRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.projectId = "";
+        message.pageSize = 0;
+        message.pageToken = "";
+        if (value !== undefined)
+            reflectionMergePartial<ListApplicationsRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListApplicationsRequest): ListApplicationsRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string project_id */ 1:
+                    message.projectId = reader.string();
+                    break;
+                case /* int32 page_size */ 2:
+                    message.pageSize = reader.int32();
+                    break;
+                case /* string page_token */ 3:
+                    message.pageToken = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListApplicationsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string project_id = 1; */
+        if (message.projectId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.projectId);
+        /* int32 page_size = 2; */
+        if (message.pageSize !== 0)
+            writer.tag(2, WireType.Varint).int32(message.pageSize);
+        /* string page_token = 3; */
+        if (message.pageToken !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.pageToken);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.ListApplicationsRequest
+ */
+export const ListApplicationsRequest = new ListApplicationsRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListApplicationsResponse$Type extends MessageType<ListApplicationsResponse> {
+    constructor() {
+        super("sid.v1.projects.ListApplicationsResponse", [
+            { no: 1, name: "applications", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => Application },
+            { no: 2, name: "next_page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ListApplicationsResponse>): ListApplicationsResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.applications = [];
+        message.nextPageToken = "";
+        if (value !== undefined)
+            reflectionMergePartial<ListApplicationsResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListApplicationsResponse): ListApplicationsResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.projects.Application applications */ 1:
+                    message.applications.push(Application.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                case /* string next_page_token */ 2:
+                    message.nextPageToken = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListApplicationsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.projects.Application applications = 1; */
+        for (let i = 0; i < message.applications.length; i++)
+            Application.internalBinaryWrite(message.applications[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string next_page_token = 2; */
+        if (message.nextPageToken !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.nextPageToken);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.ListApplicationsResponse
+ */
+export const ListApplicationsResponse = new ListApplicationsResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UpdateApplicationRequest$Type extends MessageType<UpdateApplicationRequest> {
+    constructor() {
+        super("sid.v1.projects.UpdateApplicationRequest", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "name", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<UpdateApplicationRequest>): UpdateApplicationRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        if (value !== undefined)
+            reflectionMergePartial<UpdateApplicationRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpdateApplicationRequest): UpdateApplicationRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                case /* optional string name */ 2:
+                    message.name = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: UpdateApplicationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        /* optional string name = 2; */
+        if (message.name !== undefined)
+            writer.tag(2, WireType.LengthDelimited).string(message.name);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.UpdateApplicationRequest
+ */
+export const UpdateApplicationRequest = new UpdateApplicationRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class DeleteApplicationRequest$Type extends MessageType<DeleteApplicationRequest> {
+    constructor() {
+        super("sid.v1.projects.DeleteApplicationRequest", [
+            { no: 1, name: "id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<DeleteApplicationRequest>): DeleteApplicationRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.id = "";
+        if (value !== undefined)
+            reflectionMergePartial<DeleteApplicationRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteApplicationRequest): DeleteApplicationRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string id */ 1:
+                    message.id = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: DeleteApplicationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string id = 1; */
+        if (message.id !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.id);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.DeleteApplicationRequest
+ */
+export const DeleteApplicationRequest = new DeleteApplicationRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class AddClientRoleRequest$Type extends MessageType<AddClientRoleRequest> {
+    constructor() {
+        super("sid.v1.projects.AddClientRoleRequest", [
+            { no: 1, name: "application_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "settings", kind: "message", T: () => ClientRoleSettings }
+        ]);
+    }
+    create(value?: PartialMessage<AddClientRoleRequest>): AddClientRoleRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.applicationId = "";
+        if (value !== undefined)
+            reflectionMergePartial<AddClientRoleRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AddClientRoleRequest): AddClientRoleRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string application_id */ 1:
+                    message.applicationId = reader.string();
+                    break;
+                case /* sid.v1.projects.ClientRoleSettings settings */ 2:
+                    message.settings = ClientRoleSettings.internalBinaryRead(reader, reader.uint32(), options, message.settings);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: AddClientRoleRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string application_id = 1; */
+        if (message.applicationId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.applicationId);
+        /* sid.v1.projects.ClientRoleSettings settings = 2; */
+        if (message.settings)
+            ClientRoleSettings.internalBinaryWrite(message.settings, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.AddClientRoleRequest
+ */
+export const AddClientRoleRequest = new AddClientRoleRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class UpdateClientRoleRequest$Type extends MessageType<UpdateClientRoleRequest> {
+    constructor() {
+        super("sid.v1.projects.UpdateClientRoleRequest", [
+            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "name", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "allowed_scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "grant_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "active", kind: "scalar", opt: true, T: 8 /*ScalarType.BOOL*/ },
+            { no: 7, name: "subject_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 8, name: "default_resource_id", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 9, name: "post_logout_redirect_uris", kind: "message", T: () => UriList }
+        ]);
+    }
+    create(value?: PartialMessage<UpdateClientRoleRequest>): UpdateClientRoleRequest {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.clientId = "";
+        message.redirectUris = [];
+        message.allowedScopes = [];
+        message.grantTypes = [];
+        if (value !== undefined)
+            reflectionMergePartial<UpdateClientRoleRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpdateClientRoleRequest): UpdateClientRoleRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string client_id */ 1:
+                    message.clientId = reader.string();
                     break;
-                case /* string name */ 2:
+                case /* optional string name */ 2:
                     message.name = reader.string();
                     break;
-                case /* sid.v1.projects.ApplicationType type */ 3:
-                    message.type = reader.int32();
-                    break;
-                case /* repeated string redirect_uris */ 4:
+                case /* repeated string redirect_uris */ 3:
                     message.redirectUris.push(reader.string());
                     break;
-                case /* repeated string allowed_scopes */ 5:
+                case /* repeated string allowed_scopes */ 4:
                     message.allowedScopes.push(reader.string());
                     break;
-                case /* repeated string grant_types */ 6:
+                case /* repeated string grant_types */ 5:
                     message.grantTypes.push(reader.string());
                     break;
-                case /* optional string org_id */ 7:
-                    message.orgId = reader.string();
+                case /* optional bool active */ 6:
+                    message.active = reader.bool();
+                    break;
+                case /* optional string subject_type */ 7:
+                    message.subjectType = reader.string();
+                    break;
+                case /* optional string default_resource_id */ 8:
+                    message.defaultResourceId = reader.string();
+                    break;
+                case /* optional sid.v1.projects.UriList post_logout_redirect_uris */ 9:
+                    message.postLogoutRedirectUris = UriList.internalBinaryRead(reader, reader.uint32(), options, message.postLogoutRedirectUris);
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1520,28 +3109,34 @@ class CreateApplicationRequest$Type extends MessageType<CreateApplicationRequest
         }
         return message;
     }
-    internalBinaryWrite(message: CreateApplicationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string project_id = 1; */
-        if (message.projectId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.projectId);
-        /* string name = 2; */
-        if (message.name !== "")
+    internalBinaryWrite(message: UpdateClientRoleRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string client_id = 1; */
+        if (message.clientId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.clientId);
+        /* optional string name = 2; */
+        if (message.name !== undefined)
             writer.tag(2, WireType.LengthDelimited).string(message.name);
-        /* sid.v1.projects.ApplicationType type = 3; */
-        if (message.type !== 0)
-            writer.tag(3, WireType.Varint).int32(message.type);
-        /* repeated string redirect_uris = 4; */
+        /* repeated string redirect_uris = 3; */
         for (let i = 0; i < message.redirectUris.length; i++)
-            writer.tag(4, WireType.LengthDelimited).string(message.redirectUris[i]);
-        /* repeated string allowed_scopes = 5; */
+            writer.tag(3, WireType.LengthDelimited).string(message.redirectUris[i]);
+        /* repeated string allowed_scopes = 4; */
         for (let i = 0; i < message.allowedScopes.length; i++)
-            writer.tag(5, WireType.LengthDelimited).string(message.allowedScopes[i]);
-        /* repeated string grant_types = 6; */
+            writer.tag(4, WireType.LengthDelimited).string(message.allowedScopes[i]);
+        /* repeated string grant_types = 5; */
         for (let i = 0; i < message.grantTypes.length; i++)
-            writer.tag(6, WireType.LengthDelimited).string(message.grantTypes[i]);
-        /* optional string org_id = 7; */
-        if (message.orgId !== undefined)
-            writer.tag(7, WireType.LengthDelimited).string(message.orgId);
+            writer.tag(5, WireType.LengthDelimited).string(message.grantTypes[i]);
+        /* optional bool active = 6; */
+        if (message.active !== undefined)
+            writer.tag(6, WireType.Varint).bool(message.active);
+        /* optional string subject_type = 7; */
+        if (message.subjectType !== undefined)
+            writer.tag(7, WireType.LengthDelimited).string(message.subjectType);
+        /* optional string default_resource_id = 8; */
+        if (message.defaultResourceId !== undefined)
+            writer.tag(8, WireType.LengthDelimited).string(message.defaultResourceId);
+        /* optional sid.v1.projects.UriList post_logout_redirect_uris = 9; */
+        if (message.postLogoutRedirectUris)
+            UriList.internalBinaryWrite(message.postLogoutRedirectUris, writer.tag(9, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1549,34 +3144,34 @@ class CreateApplicationRequest$Type extends MessageType<CreateApplicationRequest
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.projects.CreateApplicationRequest
+ * @generated MessageType for protobuf message sid.v1.projects.UpdateClientRoleRequest
  */
-export const CreateApplicationRequest = new CreateApplicationRequest$Type();
+export const UpdateClientRoleRequest = new UpdateClientRoleRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class CreateApplicationResponse$Type extends MessageType<CreateApplicationResponse> {
+class AddResourceRoleRequest$Type extends MessageType<AddResourceRoleRequest> {
     constructor() {
-        super("sid.v1.projects.CreateApplicationResponse", [
-            { no: 1, name: "application", kind: "message", T: () => Application },
-            { no: 2, name: "client_secret", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        super("sid.v1.projects.AddResourceRoleRequest", [
+            { no: 1, name: "application_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "settings", kind: "message", T: () => ResourceRoleSettings }
         ]);
     }
-    create(value?: PartialMessage<CreateApplicationResponse>): CreateApplicationResponse {
+    create(value?: PartialMessage<AddResourceRoleRequest>): AddResourceRoleRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.clientSecret = "";
+        message.applicationId = "";
         if (value !== undefined)
-            reflectionMergePartial<CreateApplicationResponse>(this, message, value);
+            reflectionMergePartial<AddResourceRoleRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateApplicationResponse): CreateApplicationResponse {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: AddResourceRoleRequest): AddResourceRoleRequest {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* sid.v1.projects.Application application */ 1:
-                    message.application = Application.internalBinaryRead(reader, reader.uint32(), options, message.application);
+                case /* string application_id */ 1:
+                    message.applicationId = reader.string();
                     break;
-                case /* string client_secret */ 2:
-                    message.clientSecret = reader.string();
+                case /* sid.v1.projects.ResourceRoleSettings settings */ 2:
+                    message.settings = ResourceRoleSettings.internalBinaryRead(reader, reader.uint32(), options, message.settings);
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1589,13 +3184,13 @@ class CreateApplicationResponse$Type extends MessageType<CreateApplicationRespon
         }
         return message;
     }
-    internalBinaryWrite(message: CreateApplicationResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* sid.v1.projects.Application application = 1; */
-        if (message.application)
-            Application.internalBinaryWrite(message.application, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string client_secret = 2; */
-        if (message.clientSecret !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.clientSecret);
+    internalBinaryWrite(message: AddResourceRoleRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string application_id = 1; */
+        if (message.applicationId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.applicationId);
+        /* sid.v1.projects.ResourceRoleSettings settings = 2; */
+        if (message.settings)
+            ResourceRoleSettings.internalBinaryWrite(message.settings, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1603,30 +3198,30 @@ class CreateApplicationResponse$Type extends MessageType<CreateApplicationRespon
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.projects.CreateApplicationResponse
+ * @generated MessageType for protobuf message sid.v1.projects.AddResourceRoleRequest
  */
-export const CreateApplicationResponse = new CreateApplicationResponse$Type();
+export const AddResourceRoleRequest = new AddResourceRoleRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class GetApplicationRequest$Type extends MessageType<GetApplicationRequest> {
+class ScopeList$Type extends MessageType<ScopeList> {
     constructor() {
-        super("sid.v1.projects.GetApplicationRequest", [
-            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        super("sid.v1.projects.ScopeList", [
+            { no: 1, name: "scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<GetApplicationRequest>): GetApplicationRequest {
+    create(value?: PartialMessage<ScopeList>): ScopeList {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.clientId = "";
+        message.scopes = [];
         if (value !== undefined)
-            reflectionMergePartial<GetApplicationRequest>(this, message, value);
+            reflectionMergePartial<ScopeList>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetApplicationRequest): GetApplicationRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ScopeList): ScopeList {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string client_id */ 1:
-                    message.clientId = reader.string();
+                case /* repeated string scopes */ 1:
+                    message.scopes.push(reader.string());
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1639,10 +3234,10 @@ class GetApplicationRequest$Type extends MessageType<GetApplicationRequest> {
         }
         return message;
     }
-    internalBinaryWrite(message: GetApplicationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string client_id = 1; */
-        if (message.clientId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.clientId);
+    internalBinaryWrite(message: ScopeList, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated string scopes = 1; */
+        for (let i = 0; i < message.scopes.length; i++)
+            writer.tag(1, WireType.LengthDelimited).string(message.scopes[i]);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1650,40 +3245,38 @@ class GetApplicationRequest$Type extends MessageType<GetApplicationRequest> {
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.projects.GetApplicationRequest
+ * @generated MessageType for protobuf message sid.v1.projects.ScopeList
  */
-export const GetApplicationRequest = new GetApplicationRequest$Type();
+export const ScopeList = new ScopeList$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class ListApplicationsRequest$Type extends MessageType<ListApplicationsRequest> {
+class UpdateResourceRoleRequest$Type extends MessageType<UpdateResourceRoleRequest> {
     constructor() {
-        super("sid.v1.projects.ListApplicationsRequest", [
-            { no: 1, name: "project_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "page_size", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 3, name: "page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        super("sid.v1.projects.UpdateResourceRoleRequest", [
+            { no: 1, name: "resource_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "scopes", kind: "message", T: () => ScopeList },
+            { no: 3, name: "state", kind: "enum", opt: true, T: () => ["sid.v1.projects.ResourceState", ResourceState, "RESOURCE_STATE_"] }
         ]);
     }
-    create(value?: PartialMessage<ListApplicationsRequest>): ListApplicationsRequest {
+    create(value?: PartialMessage<UpdateResourceRoleRequest>): UpdateResourceRoleRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.projectId = "";
-        message.pageSize = 0;
-        message.pageToken = "";
+        message.resourceId = "";
         if (value !== undefined)
-            reflectionMergePartial<ListApplicationsRequest>(this, message, value);
+            reflectionMergePartial<UpdateResourceRoleRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListApplicationsRequest): ListApplicationsRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpdateResourceRoleRequest): UpdateResourceRoleRequest {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* string project_id */ 1:
-                    message.projectId = reader.string();
+                case /* string resource_id */ 1:
+                    message.resourceId = reader.string();
                     break;
-                case /* int32 page_size */ 2:
-                    message.pageSize = reader.int32();
+                case /* optional sid.v1.projects.ScopeList scopes */ 2:
+                    message.scopes = ScopeList.internalBinaryRead(reader, reader.uint32(), options, message.scopes);
                     break;
-                case /* string page_token */ 3:
-                    message.pageToken = reader.string();
+                case /* optional sid.v1.projects.ResourceState state */ 3:
+                    message.state = reader.int32();
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1696,16 +3289,16 @@ class ListApplicationsRequest$Type extends MessageType<ListApplicationsRequest>
         }
         return message;
     }
-    internalBinaryWrite(message: ListApplicationsRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string project_id = 1; */
-        if (message.projectId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.projectId);
-        /* int32 page_size = 2; */
-        if (message.pageSize !== 0)
-            writer.tag(2, WireType.Varint).int32(message.pageSize);
-        /* string page_token = 3; */
-        if (message.pageToken !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.pageToken);
+    internalBinaryWrite(message: UpdateResourceRoleRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string resource_id = 1; */
+        if (message.resourceId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.resourceId);
+        /* optional sid.v1.projects.ScopeList scopes = 2; */
+        if (message.scopes)
+            ScopeList.internalBinaryWrite(message.scopes, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        /* optional sid.v1.projects.ResourceState state = 3; */
+        if (message.state !== undefined)
+            writer.tag(3, WireType.Varint).int32(message.state);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1713,35 +3306,40 @@ class ListApplicationsRequest$Type extends MessageType<ListApplicationsRequest>
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.projects.ListApplicationsRequest
+ * @generated MessageType for protobuf message sid.v1.projects.UpdateResourceRoleRequest
  */
-export const ListApplicationsRequest = new ListApplicationsRequest$Type();
+export const UpdateResourceRoleRequest = new UpdateResourceRoleRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class ListApplicationsResponse$Type extends MessageType<ListApplicationsResponse> {
+class SetResourceAccessRequest$Type extends MessageType<SetResourceAccessRequest> {
     constructor() {
-        super("sid.v1.projects.ListApplicationsResponse", [
-            { no: 1, name: "applications", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => Application },
-            { no: 2, name: "next_page_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        super("sid.v1.projects.SetResourceAccessRequest", [
+            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "resource_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<ListApplicationsResponse>): ListApplicationsResponse {
+    create(value?: PartialMessage<SetResourceAccessRequest>): SetResourceAccessRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.applications = [];
-        message.nextPageToken = "";
+        message.clientId = "";
+        message.resourceId = "";
+        message.scopes = [];
         if (value !== undefined)
-            reflectionMergePartial<ListApplicationsResponse>(this, message, value);
+            reflectionMergePartial<SetResourceAccessRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListApplicationsResponse): ListApplicationsResponse {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: SetResourceAccessRequest): SetResourceAccessRequest {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* repeated sid.v1.projects.Application applications */ 1:
-                    message.applications.push(Application.internalBinaryRead(reader, reader.uint32(), options));
+                case /* string client_id */ 1:
+                    message.clientId = reader.string();
                     break;
-                case /* string next_page_token */ 2:
-                    message.nextPageToken = reader.string();
+                case /* string resource_id */ 2:
+                    message.resourceId = reader.string();
+                    break;
+                case /* repeated string scopes */ 3:
+                    message.scopes.push(reader.string());
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1754,13 +3352,16 @@ class ListApplicationsResponse$Type extends MessageType<ListApplicationsResponse
         }
         return message;
     }
-    internalBinaryWrite(message: ListApplicationsResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated sid.v1.projects.Application applications = 1; */
-        for (let i = 0; i < message.applications.length; i++)
-            Application.internalBinaryWrite(message.applications[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        /* string next_page_token = 2; */
-        if (message.nextPageToken !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.nextPageToken);
+    internalBinaryWrite(message: SetResourceAccessRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string client_id = 1; */
+        if (message.clientId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.clientId);
+        /* string resource_id = 2; */
+        if (message.resourceId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.resourceId);
+        /* repeated string scopes = 3; */
+        for (let i = 0; i < message.scopes.length; i++)
+            writer.tag(3, WireType.LengthDelimited).string(message.scopes[i]);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1768,33 +3369,26 @@ class ListApplicationsResponse$Type extends MessageType<ListApplicationsResponse
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.projects.ListApplicationsResponse
+ * @generated MessageType for protobuf message sid.v1.projects.SetResourceAccessRequest
  */
-export const ListApplicationsResponse = new ListApplicationsResponse$Type();
+export const SetResourceAccessRequest = new SetResourceAccessRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class UpdateApplicationRequest$Type extends MessageType<UpdateApplicationRequest> {
+class RemoveResourceAccessRequest$Type extends MessageType<RemoveResourceAccessRequest> {
     constructor() {
-        super("sid.v1.projects.UpdateApplicationRequest", [
+        super("sid.v1.projects.RemoveResourceAccessRequest", [
             { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "name", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "allowed_scopes", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "grant_types", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 6, name: "active", kind: "scalar", opt: true, T: 8 /*ScalarType.BOOL*/ },
-            { no: 7, name: "subject_type", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ }
+            { no: 2, name: "resource_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<UpdateApplicationRequest>): UpdateApplicationRequest {
+    create(value?: PartialMessage<RemoveResourceAccessRequest>): RemoveResourceAccessRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.clientId = "";
-        message.redirectUris = [];
-        message.allowedScopes = [];
-        message.grantTypes = [];
+        message.resourceId = "";
         if (value !== undefined)
-            reflectionMergePartial<UpdateApplicationRequest>(this, message, value);
+            reflectionMergePartial<RemoveResourceAccessRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: UpdateApplicationRequest): UpdateApplicationRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: RemoveResourceAccessRequest): RemoveResourceAccessRequest {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
@@ -1802,23 +3396,8 @@ class UpdateApplicationRequest$Type extends MessageType<UpdateApplicationRequest
                 case /* string client_id */ 1:
                     message.clientId = reader.string();
                     break;
-                case /* optional string name */ 2:
-                    message.name = reader.string();
-                    break;
-                case /* repeated string redirect_uris */ 3:
-                    message.redirectUris.push(reader.string());
-                    break;
-                case /* repeated string allowed_scopes */ 4:
-                    message.allowedScopes.push(reader.string());
-                    break;
-                case /* repeated string grant_types */ 5:
-                    message.grantTypes.push(reader.string());
-                    break;
-                case /* optional bool active */ 6:
-                    message.active = reader.bool();
-                    break;
-                case /* optional string subject_type */ 7:
-                    message.subjectType = reader.string();
+                case /* string resource_id */ 2:
+                    message.resourceId = reader.string();
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1831,28 +3410,13 @@ class UpdateApplicationRequest$Type extends MessageType<UpdateApplicationRequest
         }
         return message;
     }
-    internalBinaryWrite(message: UpdateApplicationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+    internalBinaryWrite(message: RemoveResourceAccessRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
         /* string client_id = 1; */
         if (message.clientId !== "")
             writer.tag(1, WireType.LengthDelimited).string(message.clientId);
-        /* optional string name = 2; */
-        if (message.name !== undefined)
-            writer.tag(2, WireType.LengthDelimited).string(message.name);
-        /* repeated string redirect_uris = 3; */
-        for (let i = 0; i < message.redirectUris.length; i++)
-            writer.tag(3, WireType.LengthDelimited).string(message.redirectUris[i]);
-        /* repeated string allowed_scopes = 4; */
-        for (let i = 0; i < message.allowedScopes.length; i++)
-            writer.tag(4, WireType.LengthDelimited).string(message.allowedScopes[i]);
-        /* repeated string grant_types = 5; */
-        for (let i = 0; i < message.grantTypes.length; i++)
-            writer.tag(5, WireType.LengthDelimited).string(message.grantTypes[i]);
-        /* optional bool active = 6; */
-        if (message.active !== undefined)
-            writer.tag(6, WireType.Varint).bool(message.active);
-        /* optional string subject_type = 7; */
-        if (message.subjectType !== undefined)
-            writer.tag(7, WireType.LengthDelimited).string(message.subjectType);
+        /* string resource_id = 2; */
+        if (message.resourceId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.resourceId);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1860,30 +3424,40 @@ class UpdateApplicationRequest$Type extends MessageType<UpdateApplicationRequest
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.projects.UpdateApplicationRequest
+ * @generated MessageType for protobuf message sid.v1.projects.RemoveResourceAccessRequest
  */
-export const UpdateApplicationRequest = new UpdateApplicationRequest$Type();
+export const RemoveResourceAccessRequest = new RemoveResourceAccessRequest$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class DeleteApplicationRequest$Type extends MessageType<DeleteApplicationRequest> {
+class ListResourceAccessRequest$Type extends MessageType<ListResourceAccessRequest> {
     constructor() {
-        super("sid.v1.projects.DeleteApplicationRequest", [
-            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        super("sid.v1.projects.ListResourceAccessRequest", [
+            { no: 1, name: "client_id", kind: "scalar", oneof: "subject", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "resource_id", kind: "scalar", oneof: "subject", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
-    create(value?: PartialMessage<DeleteApplicationRequest>): DeleteApplicationRequest {
+    create(value?: PartialMessage<ListResourceAccessRequest>): ListResourceAccessRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
-        message.clientId = "";
+        message.subject = { oneofKind: undefined };
         if (value !== undefined)
-            reflectionMergePartial<DeleteApplicationRequest>(this, message, value);
+            reflectionMergePartial<ListResourceAccessRequest>(this, message, value);
         return message;
     }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteApplicationRequest): DeleteApplicationRequest {
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListResourceAccessRequest): ListResourceAccessRequest {
         let message = target ?? this.create(), end = reader.pos + length;
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
                 case /* string client_id */ 1:
-                    message.clientId = reader.string();
+                    message.subject = {
+                        oneofKind: "clientId",
+                        clientId: reader.string()
+                    };
+                    break;
+                case /* string resource_id */ 2:
+                    message.subject = {
+                        oneofKind: "resourceId",
+                        resourceId: reader.string()
+                    };
                     break;
                 default:
                     let u = options.readUnknownField;
@@ -1896,10 +3470,13 @@ class DeleteApplicationRequest$Type extends MessageType<DeleteApplicationRequest
         }
         return message;
     }
-    internalBinaryWrite(message: DeleteApplicationRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+    internalBinaryWrite(message: ListResourceAccessRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
         /* string client_id = 1; */
-        if (message.clientId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.clientId);
+        if (message.subject.oneofKind === "clientId")
+            writer.tag(1, WireType.LengthDelimited).string(message.subject.clientId);
+        /* string resource_id = 2; */
+        if (message.subject.oneofKind === "resourceId")
+            writer.tag(2, WireType.LengthDelimited).string(message.subject.resourceId);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -1907,9 +3484,56 @@ class DeleteApplicationRequest$Type extends MessageType<DeleteApplicationRequest
     }
 }
 /**
- * @generated MessageType for protobuf message sid.v1.projects.DeleteApplicationRequest
+ * @generated MessageType for protobuf message sid.v1.projects.ListResourceAccessRequest
  */
-export const DeleteApplicationRequest = new DeleteApplicationRequest$Type();
+export const ListResourceAccessRequest = new ListResourceAccessRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListResourceAccessResponse$Type extends MessageType<ListResourceAccessResponse> {
+    constructor() {
+        super("sid.v1.projects.ListResourceAccessResponse", [
+            { no: 1, name: "access", kind: "message", repeat: 2 /*RepeatType.UNPACKED*/, T: () => ResourceAccess }
+        ]);
+    }
+    create(value?: PartialMessage<ListResourceAccessResponse>): ListResourceAccessResponse {
+        const message = globalThis.Object.create((this.messagePrototype!));
+        message.access = [];
+        if (value !== undefined)
+            reflectionMergePartial<ListResourceAccessResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListResourceAccessResponse): ListResourceAccessResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated sid.v1.projects.ResourceAccess access */ 1:
+                    message.access.push(ResourceAccess.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListResourceAccessResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated sid.v1.projects.ResourceAccess access = 1; */
+        for (let i = 0; i < message.access.length; i++)
+            ResourceAccess.internalBinaryWrite(message.access[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message sid.v1.projects.ListResourceAccessResponse
+ */
+export const ListResourceAccessResponse = new ListResourceAccessResponse$Type();
 // @generated message type with reflection information, may provide speed optimized methods
 class AddRoleRequest$Type extends MessageType<AddRoleRequest> {
     constructor() {
@@ -2063,7 +3687,10 @@ class RegisterClientRequest$Type extends MessageType<RegisterClientRequest> {
             { no: 7, name: "subject_type", kind: "enum", T: () => ["sid.v1.projects.SubjectType", SubjectType, "SUBJECT_TYPE_"] },
             { no: 8, name: "sector_identifier_uri", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
             { no: 9, name: "contacts", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 10, name: "scope", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+            { no: 10, name: "scope", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 11, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 12, name: "jwks", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 13, name: "post_logout_redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<RegisterClientRequest>): RegisterClientRequest {
@@ -2077,6 +3704,8 @@ class RegisterClientRequest$Type extends MessageType<RegisterClientRequest> {
         message.subjectType = 0;
         message.contacts = [];
         message.scope = [];
+        message.issuerHandle = "";
+        message.postLogoutRedirectUris = [];
         if (value !== undefined)
             reflectionMergePartial<RegisterClientRequest>(this, message, value);
         return message;
@@ -2116,6 +3745,15 @@ class RegisterClientRequest$Type extends MessageType<RegisterClientRequest> {
                 case /* repeated string scope */ 10:
                     message.scope.push(reader.string());
                     break;
+                case /* string issuer_handle */ 11:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* optional string jwks */ 12:
+                    message.jwks = reader.string();
+                    break;
+                case /* repeated string post_logout_redirect_uris */ 13:
+                    message.postLogoutRedirectUris.push(reader.string());
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -2158,6 +3796,15 @@ class RegisterClientRequest$Type extends MessageType<RegisterClientRequest> {
         /* repeated string scope = 10; */
         for (let i = 0; i < message.scope.length; i++)
             writer.tag(10, WireType.LengthDelimited).string(message.scope[i]);
+        /* string issuer_handle = 11; */
+        if (message.issuerHandle !== "")
+            writer.tag(11, WireType.LengthDelimited).string(message.issuerHandle);
+        /* optional string jwks = 12; */
+        if (message.jwks !== undefined)
+            writer.tag(12, WireType.LengthDelimited).string(message.jwks);
+        /* repeated string post_logout_redirect_uris = 13; */
+        for (let i = 0; i < message.postLogoutRedirectUris.length; i++)
+            writer.tag(13, WireType.LengthDelimited).string(message.postLogoutRedirectUris[i]);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -2172,7 +3819,7 @@ export const RegisterClientRequest = new RegisterClientRequest$Type();
 class RegisterClientResponse$Type extends MessageType<RegisterClientResponse> {
     constructor() {
         super("sid.v1.projects.RegisterClientResponse", [
-            { no: 1, name: "application", kind: "message", T: () => Application },
+            { no: 1, name: "client", kind: "message", T: () => OAuthClient },
             { no: 2, name: "client_secret", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
             { no: 3, name: "registration_access_token", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
@@ -2189,8 +3836,8 @@ class RegisterClientResponse$Type extends MessageType<RegisterClientResponse> {
         while (reader.pos < end) {
             let [fieldNo, wireType] = reader.tag();
             switch (fieldNo) {
-                case /* sid.v1.projects.Application application */ 1:
-                    message.application = Application.internalBinaryRead(reader, reader.uint32(), options, message.application);
+                case /* sid.v1.projects.OAuthClient client */ 1:
+                    message.client = OAuthClient.internalBinaryRead(reader, reader.uint32(), options, message.client);
                     break;
                 case /* optional string client_secret */ 2:
                     message.clientSecret = reader.string();
@@ -2210,9 +3857,9 @@ class RegisterClientResponse$Type extends MessageType<RegisterClientResponse> {
         return message;
     }
     internalBinaryWrite(message: RegisterClientResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* sid.v1.projects.Application application = 1; */
-        if (message.application)
-            Application.internalBinaryWrite(message.application, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* sid.v1.projects.OAuthClient client = 1; */
+        if (message.client)
+            OAuthClient.internalBinaryWrite(message.client, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
         /* optional string client_secret = 2; */
         if (message.clientSecret !== undefined)
             writer.tag(2, WireType.LengthDelimited).string(message.clientSecret);
@@ -2233,12 +3880,14 @@ export const RegisterClientResponse = new RegisterClientResponse$Type();
 class GetRegisteredClientRequest$Type extends MessageType<GetRegisteredClientRequest> {
     constructor() {
         super("sid.v1.projects.GetRegisteredClientRequest", [
-            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<GetRegisteredClientRequest>): GetRegisteredClientRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.clientId = "";
+        message.issuerHandle = "";
         if (value !== undefined)
             reflectionMergePartial<GetRegisteredClientRequest>(this, message, value);
         return message;
@@ -2251,6 +3900,9 @@ class GetRegisteredClientRequest$Type extends MessageType<GetRegisteredClientReq
                 case /* string client_id */ 1:
                     message.clientId = reader.string();
                     break;
+                case /* string issuer_handle */ 2:
+                    message.issuerHandle = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -2266,6 +3918,9 @@ class GetRegisteredClientRequest$Type extends MessageType<GetRegisteredClientReq
         /* string client_id = 1; */
         if (message.clientId !== "")
             writer.tag(1, WireType.LengthDelimited).string(message.clientId);
+        /* string issuer_handle = 2; */
+        if (message.issuerHandle !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.issuerHandle);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -2289,7 +3944,11 @@ class UpdateRegisteredClientRequest$Type extends MessageType<UpdateRegisteredCli
             { no: 7, name: "subject_type", kind: "enum", opt: true, T: () => ["sid.v1.projects.SubjectType", SubjectType, "SUBJECT_TYPE_"] },
             { no: 8, name: "sector_identifier_uri", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
             { no: 9, name: "contacts", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 10, name: "scope", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+            { no: 10, name: "scope", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 11, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 12, name: "client_secret", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 13, name: "jwks", kind: "scalar", opt: true, T: 9 /*ScalarType.STRING*/ },
+            { no: 14, name: "post_logout_redirect_uris", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<UpdateRegisteredClientRequest>): UpdateRegisteredClientRequest {
@@ -2300,6 +3959,8 @@ class UpdateRegisteredClientRequest$Type extends MessageType<UpdateRegisteredCli
         message.responseTypes = [];
         message.contacts = [];
         message.scope = [];
+        message.issuerHandle = "";
+        message.postLogoutRedirectUris = [];
         if (value !== undefined)
             reflectionMergePartial<UpdateRegisteredClientRequest>(this, message, value);
         return message;
@@ -2339,6 +4000,18 @@ class UpdateRegisteredClientRequest$Type extends MessageType<UpdateRegisteredCli
                 case /* repeated string scope */ 10:
                     message.scope.push(reader.string());
                     break;
+                case /* string issuer_handle */ 11:
+                    message.issuerHandle = reader.string();
+                    break;
+                case /* optional string client_secret */ 12:
+                    message.clientSecret = reader.string();
+                    break;
+                case /* optional string jwks */ 13:
+                    message.jwks = reader.string();
+                    break;
+                case /* repeated string post_logout_redirect_uris */ 14:
+                    message.postLogoutRedirectUris.push(reader.string());
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -2381,6 +4054,18 @@ class UpdateRegisteredClientRequest$Type extends MessageType<UpdateRegisteredCli
         /* repeated string scope = 10; */
         for (let i = 0; i < message.scope.length; i++)
             writer.tag(10, WireType.LengthDelimited).string(message.scope[i]);
+        /* string issuer_handle = 11; */
+        if (message.issuerHandle !== "")
+            writer.tag(11, WireType.LengthDelimited).string(message.issuerHandle);
+        /* optional string client_secret = 12; */
+        if (message.clientSecret !== undefined)
+            writer.tag(12, WireType.LengthDelimited).string(message.clientSecret);
+        /* optional string jwks = 13; */
+        if (message.jwks !== undefined)
+            writer.tag(13, WireType.LengthDelimited).string(message.jwks);
+        /* repeated string post_logout_redirect_uris = 14; */
+        for (let i = 0; i < message.postLogoutRedirectUris.length; i++)
+            writer.tag(14, WireType.LengthDelimited).string(message.postLogoutRedirectUris[i]);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -2395,12 +4080,14 @@ export const UpdateRegisteredClientRequest = new UpdateRegisteredClientRequest$T
 class DeleteRegisteredClientRequest$Type extends MessageType<DeleteRegisteredClientRequest> {
     constructor() {
         super("sid.v1.projects.DeleteRegisteredClientRequest", [
-            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+            { no: 1, name: "client_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "issuer_handle", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
     create(value?: PartialMessage<DeleteRegisteredClientRequest>): DeleteRegisteredClientRequest {
         const message = globalThis.Object.create((this.messagePrototype!));
         message.clientId = "";
+        message.issuerHandle = "";
         if (value !== undefined)
             reflectionMergePartial<DeleteRegisteredClientRequest>(this, message, value);
         return message;
@@ -2413,6 +4100,9 @@ class DeleteRegisteredClientRequest$Type extends MessageType<DeleteRegisteredCli
                 case /* string client_id */ 1:
                     message.clientId = reader.string();
                     break;
+                case /* string issuer_handle */ 2:
+                    message.issuerHandle = reader.string();
+                    break;
                 default:
                     let u = options.readUnknownField;
                     if (u === "throw")
@@ -2428,6 +4118,9 @@ class DeleteRegisteredClientRequest$Type extends MessageType<DeleteRegisteredCli
         /* string client_id = 1; */
         if (message.clientId !== "")
             writer.tag(1, WireType.LengthDelimited).string(message.clientId);
+        /* string issuer_handle = 2; */
+        if (message.issuerHandle !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.issuerHandle);
         let u = options.writeUnknownFields;
         if (u !== false)
             (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
@@ -2729,17 +4422,24 @@ export const ProjectService = new ServiceType("sid.v1.projects.ProjectService",
     { name: "ListProjects", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/projects" } }, I: ListProjectsRequest, O: ListProjectsResponse },
     { name: "UpdateProject", idempotency: "IDEMPOTENT", options: { "google.api.http": { patch: "/v1/projects/{id}", body: "*" } }, I: UpdateProjectRequest, O: Project },
     { name: "DeleteProject", idempotency: "IDEMPOTENT", options: { "google.api.http": { delete: "/v1/projects/{id}" } }, I: DeleteProjectRequest, O: Empty },
-    { name: "CreateApplication", idempotency: "IDEMPOTENT", options: { "google.api.http": { post: "/v1/projects/{project_id}/applications", body: "*" } }, I: CreateApplicationRequest, O: CreateApplicationResponse },
-    { name: "GetApplication", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/projects/applications/{client_id}" } }, I: GetApplicationRequest, O: Application },
+    { name: "CreateApplication", options: { "google.api.http": { post: "/v1/projects/{project_id}/applications", body: "*" } }, I: CreateApplicationRequest, O: CreateApplicationResponse },
+    { name: "GetApplication", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/applications/{id}" } }, I: GetApplicationRequest, O: Application },
     { name: "ListApplications", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/projects/{project_id}/applications" } }, I: ListApplicationsRequest, O: ListApplicationsResponse },
-    { name: "UpdateApplication", idempotency: "IDEMPOTENT", options: { "google.api.http": { patch: "/v1/projects/applications/{client_id}", body: "*" } }, I: UpdateApplicationRequest, O: Application },
-    { name: "DeleteApplication", idempotency: "IDEMPOTENT", options: { "google.api.http": { delete: "/v1/projects/applications/{client_id}" } }, I: DeleteApplicationRequest, O: Empty },
+    { name: "UpdateApplication", idempotency: "IDEMPOTENT", options: { "google.api.http": { patch: "/v1/applications/{id}", body: "*" } }, I: UpdateApplicationRequest, O: Application },
+    { name: "DeleteApplication", idempotency: "IDEMPOTENT", options: { "google.api.http": { delete: "/v1/applications/{id}" } }, I: DeleteApplicationRequest, O: Empty },
+    { name: "AddClientRole", options: { "google.api.http": { post: "/v1/applications/{application_id}/client", body: "*" } }, I: AddClientRoleRequest, O: CreateApplicationResponse },
+    { name: "UpdateClientRole", idempotency: "IDEMPOTENT", options: { "google.api.http": { patch: "/v1/clients/{client_id}", body: "*" } }, I: UpdateClientRoleRequest, O: Application },
+    { name: "AddResourceRole", options: { "google.api.http": { post: "/v1/applications/{application_id}/resource", body: "*" } }, I: AddResourceRoleRequest, O: Application },
+    { name: "UpdateResourceRole", idempotency: "IDEMPOTENT", options: { "google.api.http": { patch: "/v1/resources/{resource_id}", body: "*" } }, I: UpdateResourceRoleRequest, O: ProtectedResource },
+    { name: "SetResourceAccess", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/clients/{client_id}/resources/{resource_id}", body: "*" } }, I: SetResourceAccessRequest, O: ResourceAccess },
+    { name: "RemoveResourceAccess", idempotency: "IDEMPOTENT", options: { "google.api.http": { delete: "/v1/clients/{client_id}/resources/{resource_id}" } }, I: RemoveResourceAccessRequest, O: Empty },
+    { name: "ListResourceAccess", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/clients/{client_id}/resources", additionalBindings: [{ get: "/v1/resources/{resource_id}/clients" }] } }, I: ListResourceAccessRequest, O: ListResourceAccessResponse },
     { name: "AddRole", idempotency: "IDEMPOTENT", options: { "google.api.http": { post: "/v1/projects/{project_id}/roles", body: "*" } }, I: AddRoleRequest, O: Role },
     { name: "RemoveRole", idempotency: "IDEMPOTENT", options: { "google.api.http": { delete: "/v1/projects/{project_id}/roles/{role_id}" } }, I: RemoveRoleRequest, O: Empty },
-    { name: "RegisterClient", idempotency: "IDEMPOTENT", options: { "google.api.http": { post: "/v1/projects/dcr/register", body: "*" } }, I: RegisterClientRequest, O: RegisterClientResponse },
-    { name: "GetRegisteredClient", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/projects/dcr/clients/{client_id}" } }, I: GetRegisteredClientRequest, O: Application },
-    { name: "UpdateRegisteredClient", idempotency: "IDEMPOTENT", options: { "google.api.http": { put: "/v1/projects/dcr/clients/{client_id}", body: "*" } }, I: UpdateRegisteredClientRequest, O: Application },
-    { name: "DeleteRegisteredClient", idempotency: "IDEMPOTENT", options: { "google.api.http": { delete: "/v1/projects/dcr/clients/{client_id}" } }, I: DeleteRegisteredClientRequest, O: Empty },
+    { name: "RegisterClient", options: {}, I: RegisterClientRequest, O: RegisterClientResponse },
+    { name: "GetRegisteredClient", idempotency: "NO_SIDE_EFFECTS", options: {}, I: GetRegisteredClientRequest, O: OAuthClient },
+    { name: "UpdateRegisteredClient", idempotency: "IDEMPOTENT", options: {}, I: UpdateRegisteredClientRequest, O: OAuthClient },
+    { name: "DeleteRegisteredClient", idempotency: "IDEMPOTENT", options: {}, I: DeleteRegisteredClientRequest, O: Empty },
     { name: "CreateInitialAccessToken", idempotency: "IDEMPOTENT", options: { "google.api.http": { post: "/v1/projects/{project_id}/iat", body: "*" } }, I: CreateInitialAccessTokenRequest, O: CreateInitialAccessTokenResponse },
     { name: "ListInitialAccessTokens", idempotency: "NO_SIDE_EFFECTS", options: { "google.api.http": { get: "/v1/projects/{project_id}/iat" } }, I: ListInitialAccessTokensRequest, O: ListInitialAccessTokensResponse },
     { name: "RevokeInitialAccessToken", idempotency: "IDEMPOTENT", options: { "google.api.http": { delete: "/v1/projects/iat/{id}" } }, I: RevokeInitialAccessTokenRequest, O: Empty }