@inkeep/agents-core 0.0.0-dev-20260118170655 → 0.0.0-dev-20260119163620

package/dist/auth/auth-validation-schemas.d.ts

@@ -1,9 +1,9 @@
 import { z } from "@hono/zod-openapi";
 import * as drizzle_orm_pg_core1074 from "drizzle-orm/pg-core";
-import * as drizzle_zod167 from "drizzle-zod";
+import * as drizzle_zod171 from "drizzle-zod";
 
 //#region src/auth/auth-validation-schemas.d.ts
-declare const UserSelectSchema: drizzle_zod167.BuildSchema<"select", {
+declare const UserSelectSchema: drizzle_zod171.BuildSchema<"select", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "user";
@@ -124,7 +124,7 @@ declare const UserSelectSchema: drizzle_zod167.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const UserInsertSchema: drizzle_zod167.BuildSchema<"insert", {
+declare const UserInsertSchema: drizzle_zod171.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "user";
@@ -245,7 +245,7 @@ declare const UserInsertSchema: drizzle_zod167.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const SessionSelectSchema: drizzle_zod167.BuildSchema<"select", {
+declare const SessionSelectSchema: drizzle_zod171.BuildSchema<"select", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "session";
@@ -400,7 +400,7 @@ declare const SessionSelectSchema: drizzle_zod167.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const SessionInsertSchema: drizzle_zod167.BuildSchema<"insert", {
+declare const SessionInsertSchema: drizzle_zod171.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "session";
@@ -555,7 +555,7 @@ declare const SessionInsertSchema: drizzle_zod167.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const AccountSelectSchema: drizzle_zod167.BuildSchema<"select", {
+declare const AccountSelectSchema: drizzle_zod171.BuildSchema<"select", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "account";
@@ -778,7 +778,7 @@ declare const AccountSelectSchema: drizzle_zod167.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const AccountInsertSchema: drizzle_zod167.BuildSchema<"insert", {
+declare const AccountInsertSchema: drizzle_zod171.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "account";
@@ -1001,7 +1001,7 @@ declare const AccountInsertSchema: drizzle_zod167.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const OrganizationSelectSchema: drizzle_zod167.BuildSchema<"select", {
+declare const OrganizationSelectSchema: drizzle_zod171.BuildSchema<"select", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "organization";
@@ -1105,7 +1105,7 @@ declare const OrganizationSelectSchema: drizzle_zod167.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const OrganizationInsertSchema: drizzle_zod167.BuildSchema<"insert", {
+declare const OrganizationInsertSchema: drizzle_zod171.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "organization";
@@ -1209,7 +1209,7 @@ declare const OrganizationInsertSchema: drizzle_zod167.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const MemberSelectSchema: drizzle_zod167.BuildSchema<"select", {
+declare const MemberSelectSchema: drizzle_zod171.BuildSchema<"select", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "member";
@@ -1296,7 +1296,7 @@ declare const MemberSelectSchema: drizzle_zod167.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const MemberInsertSchema: drizzle_zod167.BuildSchema<"insert", {
+declare const MemberInsertSchema: drizzle_zod171.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "member";
@@ -1383,7 +1383,7 @@ declare const MemberInsertSchema: drizzle_zod167.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const InvitationSelectSchema: drizzle_zod167.BuildSchema<"select", {
+declare const InvitationSelectSchema: drizzle_zod171.BuildSchema<"select", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "invitation";
@@ -1521,7 +1521,7 @@ declare const InvitationSelectSchema: drizzle_zod167.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const InvitationInsertSchema: drizzle_zod167.BuildSchema<"insert", {
+declare const InvitationInsertSchema: drizzle_zod171.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "invitation";
@@ -1659,7 +1659,7 @@ declare const InvitationInsertSchema: drizzle_zod167.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const DeviceCodeSelectSchema: drizzle_zod167.BuildSchema<"select", {
+declare const DeviceCodeSelectSchema: drizzle_zod171.BuildSchema<"select", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "device_code";
@@ -1831,7 +1831,7 @@ declare const DeviceCodeSelectSchema: drizzle_zod167.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const DeviceCodeInsertSchema: drizzle_zod167.BuildSchema<"insert", {
+declare const DeviceCodeInsertSchema: drizzle_zod171.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "device_code";
@@ -2003,7 +2003,7 @@ declare const DeviceCodeInsertSchema: drizzle_zod167.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const VerificationSelectSchema: drizzle_zod167.BuildSchema<"select", {
+declare const VerificationSelectSchema: drizzle_zod171.BuildSchema<"select", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "verification";
@@ -2107,7 +2107,7 @@ declare const VerificationSelectSchema: drizzle_zod167.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const VerificationInsertSchema: drizzle_zod167.BuildSchema<"insert", {
+declare const VerificationInsertSchema: drizzle_zod171.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1074.PgColumn<{
     name: "id";
     tableName: "verification";

package/dist/auth/auth.d.ts

@@ -2,7 +2,7 @@ import { AgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
 import * as _better_auth_sso0 from "@better-auth/sso";
 import * as better_auth0 from "better-auth";
 import { BetterAuthAdvancedOptions } from "better-auth";
-import * as better_auth_plugins0 from "better-auth/plugins";
+import * as better_auth_plugins20 from "better-auth/plugins";
 import * as zod0 from "zod";
 import { GoogleOptions } from "better-auth/social-providers";
 
@@ -213,7 +213,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
       }[];
     };
-    options: better_auth_plugins0.BearerOptions | undefined;
+    options: better_auth_plugins20.BearerOptions | undefined;
   }, {
     id: "sso";
     endpoints: {
@@ -841,30 +841,30 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     };
   }, {
     id: "organization";
-    endpoints: better_auth_plugins0.OrganizationEndpoints<{
+    endpoints: better_auth_plugins20.OrganizationEndpoints<{
       allowUserToCreateOrganization: true;
-      ac: better_auth_plugins0.AccessControl;
+      ac: better_auth_plugins20.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
         admin: {
-          authorize<K_1 extends "function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
         owner: {
-          authorize<K_1 extends "function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
       };
       membershipLimit: number;
@@ -874,12 +874,42 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         role: string;
         email: string;
-        organization: better_auth_plugins0.Organization;
-        invitation: better_auth_plugins0.Invitation;
-        inviter: better_auth_plugins0.Member & {
+        organization: better_auth_plugins20.Organization;
+        invitation: better_auth_plugins20.Invitation;
+        inviter: better_auth_plugins20.Member & {
           user: better_auth0.User;
         };
       }): Promise<void>;
+      organizationHooks: {
+        afterAcceptInvitation: ({
+          member,
+          user,
+          organization: org
+        }: {
+          invitation: better_auth_plugins20.Invitation & Record<string, any>;
+          member: better_auth_plugins20.Member & Record<string, any>;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
+        }) => Promise<void>;
+        afterUpdateMemberRole: ({
+          member,
+          organization: org,
+          previousRole
+        }: {
+          member: better_auth_plugins20.Member & Record<string, any>;
+          previousRole: string;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
+        }) => Promise<void>;
+        afterRemoveMember: ({
+          member,
+          organization: org
+        }: {
+          member: better_auth_plugins20.Member & Record<string, any>;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
+        }) => Promise<void>;
+      };
     }>;
     schema: {
       organization: {
@@ -1008,8 +1038,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         organizationId: string;
         email: string;
-        role: "member" | "admin" | "owner";
-        status: better_auth_plugins0.InvitationStatus;
+        role: "member" | "owner" | "admin";
+        status: better_auth_plugins20.InvitationStatus;
         inviterId: string;
         expiresAt: Date;
         createdAt: Date;
@@ -1017,7 +1047,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       Member: {
         id: string;
         organizationId: string;
-        role: "member" | "admin" | "owner";
+        role: "member" | "owner" | "admin";
         createdAt: Date;
         userId: string;
         user: {
@@ -1033,7 +1063,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         members: {
           id: string;
           organizationId: string;
-          role: "member" | "admin" | "owner";
+          role: "member" | "owner" | "admin";
           createdAt: Date;
           userId: string;
           user: {
@@ -1047,8 +1077,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           id: string;
           organizationId: string;
           email: string;
-          role: "member" | "admin" | "owner";
-          status: better_auth_plugins0.InvitationStatus;
+          role: "member" | "owner" | "admin";
+          status: better_auth_plugins20.InvitationStatus;
           inviterId: string;
           expiresAt: Date;
           createdAt: Date;
@@ -1122,28 +1152,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     };
     options: NoInfer<{
       allowUserToCreateOrganization: true;
-      ac: better_auth_plugins0.AccessControl;
+      ac: better_auth_plugins20.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
         admin: {
-          authorize<K_1 extends "function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
         owner: {
-          authorize<K_1 extends "function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
+            actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "agent" | "project" | "organization" | "credential" | "tool" | "member" | "invitation" | "ac" | "sub_agent" | "api_key" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
+          statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
         };
       };
       membershipLimit: number;
@@ -1153,12 +1183,42 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         role: string;
         email: string;
-        organization: better_auth_plugins0.Organization;
-        invitation: better_auth_plugins0.Invitation;
-        inviter: better_auth_plugins0.Member & {
+        organization: better_auth_plugins20.Organization;
+        invitation: better_auth_plugins20.Invitation;
+        inviter: better_auth_plugins20.Member & {
           user: better_auth0.User;
         };
       }): Promise<void>;
+      organizationHooks: {
+        afterAcceptInvitation: ({
+          member,
+          user,
+          organization: org
+        }: {
+          invitation: better_auth_plugins20.Invitation & Record<string, any>;
+          member: better_auth_plugins20.Member & Record<string, any>;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
+        }) => Promise<void>;
+        afterUpdateMemberRole: ({
+          member,
+          organization: org,
+          previousRole
+        }: {
+          member: better_auth_plugins20.Member & Record<string, any>;
+          previousRole: string;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
+        }) => Promise<void>;
+        afterRemoveMember: ({
+          member,
+          organization: org
+        }: {
+          member: better_auth_plugins20.Member & Record<string, any>;
+          user: better_auth0.User & Record<string, any>;
+          organization: better_auth_plugins20.Organization & Record<string, any>;
+        }) => Promise<void>;
+      };
     }>;
   }, {
     id: "device-authorization";
@@ -1493,8 +1553,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       readonly AUTHENTICATION_REQUIRED: "Authentication required";
     };
     options: Partial<{
-      expiresIn: better_auth_plugins0.TimeString;
-      interval: better_auth_plugins0.TimeString;
+      expiresIn: better_auth_plugins20.TimeString;
+      interval: better_auth_plugins20.TimeString;
       deviceCodeLength: number;
       userCodeLength: number;
       schema: {

package/dist/auth/auth.js

@@ -139,6 +139,52 @@ function createAuth(config) {
 						organization: data.organization.name,
 						invitationId: data.id
 					});
+				},
+				organizationHooks: {
+					afterAcceptInvitation: async ({ member: member$1, user, organization: org }) => {
+						try {
+							const { syncOrgMemberToSpiceDb } = await import("./authz/sync.js");
+							await syncOrgMemberToSpiceDb({
+								tenantId: org.id,
+								userId: user.id,
+								role: member$1.role,
+								action: "add"
+							});
+							console.log(`🔐 SpiceDB: Synced member ${user.email} as ${member$1.role} to org ${org.name}`);
+						} catch (error) {
+							console.error("❌ SpiceDB sync failed for new member:", error);
+						}
+					},
+					afterUpdateMemberRole: async ({ member: member$1, organization: org, previousRole }) => {
+						try {
+							const { changeOrgRole } = await import("./authz/sync.js");
+							const oldRole = previousRole;
+							const newRole = member$1.role;
+							await changeOrgRole({
+								tenantId: org.id,
+								userId: member$1.userId,
+								oldRole,
+								newRole
+							});
+							console.log(`🔐 SpiceDB: Updated member ${member$1.userId} role from ${oldRole} to ${newRole} in org ${org.name}`);
+						} catch (error) {
+							console.error("❌ SpiceDB sync failed for role update:", error);
+						}
+					},
+					afterRemoveMember: async ({ member: member$1, organization: org }) => {
+						try {
+							const { syncOrgMemberToSpiceDb } = await import("./authz/sync.js");
+							await syncOrgMemberToSpiceDb({
+								tenantId: org.id,
+								userId: member$1.userId,
+								role: member$1.role,
+								action: "remove"
+							});
+							console.log(`🔐 SpiceDB: Removed member ${member$1.userId} from org ${org.name}`);
+						} catch (error) {
+							console.error("❌ SpiceDB sync failed for member removal:", error);
+						}
+					}
 				}
 			}),
 			deviceAuthorization({

package/dist/auth/authz/client.d.ts

@@ -0,0 +1,81 @@
+import { v1 } from "@authzed/authzed-node";
+
+//#region src/auth/authz/client.d.ts
+
+type ZedClientInterface = ReturnType<typeof v1.NewClient>;
+/**
+ * Get the SpiceDB client singleton.
+ * Creates a new client on first call.
+ */
+declare function getSpiceClient(): ZedClientInterface;
+/**
+ * Reset the client (useful for testing)
+ */
+declare function resetSpiceClient(): void;
+/**
+ * Check if a subject has a permission on a resource.
+ * Note: Caller must verify isAuthzEnabled(tenantId) before calling.
+ */
+declare function checkPermission(params: {
+  resourceType: string;
+  resourceId: string;
+  permission: string;
+  subjectType: string;
+  subjectId: string;
+}): Promise<boolean>;
+/**
+ * Check multiple permissions on a resource in a single request.
+ * More efficient than multiple checkPermission calls.
+ *
+ * @returns Record mapping permission names to boolean results
+ */
+declare function checkBulkPermissions(params: {
+  resourceType: string;
+  resourceId: string;
+  permissions: string[];
+  subjectType: string;
+  subjectId: string;
+}): Promise<Record<string, boolean>>;
+/**
+ * Find all resources of a type that a subject has a permission on.
+ */
+declare function lookupResources(params: {
+  resourceType: string;
+  permission: string;
+  subjectType: string;
+  subjectId: string;
+}): Promise<string[]>;
+/**
+ * Write a relationship to SpiceDB.
+ */
+declare function writeRelationship(params: {
+  resourceType: string;
+  resourceId: string;
+  relation: string;
+  subjectType: string;
+  subjectId: string;
+}): Promise<void>;
+/**
+ * Delete a relationship from SpiceDB.
+ */
+declare function deleteRelationship(params: {
+  resourceType: string;
+  resourceId: string;
+  relation: string;
+  subjectType: string;
+  subjectId: string;
+}): Promise<void>;
+/**
+ * Read relationships for a resource to list subjects with access.
+ */
+declare function readRelationships(params: {
+  resourceType: string;
+  resourceId: string;
+  relation?: string;
+}): Promise<Array<{
+  subjectType: string;
+  subjectId: string;
+  relation: string;
+}>>;
+//#endregion
+export { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, v1, writeRelationship };