@inkeep/agents-core 0.38.2 → 0.39.0

package/dist/auth/auth.d.ts

@@ -4,10 +4,10 @@ import * as zod from 'zod';
 import * as better_auth from 'better-auth';
 import { BetterAuthAdvancedOptions } from 'better-auth';
 import { GoogleOptions } from 'better-auth/social-providers';
-import { D as DatabaseClient } from '../client-DG_xZdlN.js';
+import { D as DatabaseClient } from '../client-DmOy13ep.js';
 import 'drizzle-orm/node-postgres';
 import 'drizzle-orm/pglite';
-import '../schema-DA6PfmoP.js';
+import '../schema-Bq_OERAy.js';
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
 import '../utility-dsfXkYTu.js';
@@ -126,6 +126,22 @@ declare function createAuth(config: BetterAuthConfig): better_auth.Auth<{
     };
     trustedOrigins: string[];
     plugins: [{
+        id: "bearer";
+        hooks: {
+            before: {
+                matcher(context: better_auth.HookEndpointContext): boolean;
+                handler: (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<{
+                    context: {
+                        headers: Headers;
+                    };
+                } | undefined>;
+            }[];
+            after: {
+                matcher(context: better_auth.HookEndpointContext): true;
+                handler: (inputContext: better_auth.MiddlewareInputContext<better_auth.MiddlewareOptions>) => Promise<void>;
+            }[];
+        };
+    }, {
         id: "sso";
         endpoints: {
             spMetadata: ReturnType<() => better_auth.StrictEndpoint<"/sso/saml2/sp/metadata", {
@@ -1025,6 +1041,348 @@ declare function createAuth(config: BetterAuthConfig): better_auth.Auth<{
                 };
             }): Promise<void>;
         };
+    }, {
+        id: "device-authorization";
+        schema: {
+            deviceCode: {
+                fields: {
+                    deviceCode: {
+                        type: "string";
+                        required: true;
+                    };
+                    userCode: {
+                        type: "string";
+                        required: true;
+                    };
+                    userId: {
+                        type: "string";
+                        required: false;
+                    };
+                    expiresAt: {
+                        type: "date";
+                        required: true;
+                    };
+                    status: {
+                        type: "string";
+                        required: true;
+                    };
+                    lastPolledAt: {
+                        type: "date";
+                        required: false;
+                    };
+                    pollingInterval: {
+                        type: "number";
+                        required: false;
+                    };
+                    clientId: {
+                        type: "string";
+                        required: false;
+                    };
+                    scope: {
+                        type: "string";
+                        required: false;
+                    };
+                };
+            };
+        };
+        endpoints: {
+            deviceCode: better_auth.StrictEndpoint<"/device/code", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    client_id: zod.ZodString;
+                    scope: zod.ZodOptional<zod.ZodString>;
+                }, better_auth.$strip>;
+                error: zod.ZodObject<{
+                    error: zod.ZodEnum<{
+                        invalid_request: "invalid_request";
+                        invalid_client: "invalid_client";
+                    }>;
+                    error_description: zod.ZodString;
+                }, better_auth.$strip>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                device_code: {
+                                                    type: string;
+                                                    description: string;
+                                                };
+                                                user_code: {
+                                                    type: string;
+                                                    description: string;
+                                                };
+                                                verification_uri: {
+                                                    type: string;
+                                                    format: string;
+                                                    description: string;
+                                                };
+                                                verification_uri_complete: {
+                                                    type: string;
+                                                    format: string;
+                                                    description: string;
+                                                };
+                                                expires_in: {
+                                                    type: string;
+                                                    description: string;
+                                                };
+                                                interval: {
+                                                    type: string;
+                                                    description: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                            400: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                error: {
+                                                    type: string;
+                                                    enum: string[];
+                                                };
+                                                error_description: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            }, {
+                device_code: string;
+                user_code: string;
+                verification_uri: string;
+                verification_uri_complete: string;
+                expires_in: number;
+                interval: number;
+            }>;
+            deviceToken: better_auth.StrictEndpoint<"/device/token", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    grant_type: zod.ZodLiteral<"urn:ietf:params:oauth:grant-type:device_code">;
+                    device_code: zod.ZodString;
+                    client_id: zod.ZodString;
+                }, better_auth.$strip>;
+                error: zod.ZodObject<{
+                    error: zod.ZodEnum<{
+                        invalid_request: "invalid_request";
+                        authorization_pending: "authorization_pending";
+                        slow_down: "slow_down";
+                        expired_token: "expired_token";
+                        access_denied: "access_denied";
+                        invalid_grant: "invalid_grant";
+                    }>;
+                    error_description: zod.ZodString;
+                }, better_auth.$strip>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                session: {
+                                                    $ref: string;
+                                                };
+                                                user: {
+                                                    $ref: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                            400: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                error: {
+                                                    type: string;
+                                                    enum: string[];
+                                                };
+                                                error_description: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            }, {
+                access_token: string;
+                token_type: string;
+                expires_in: number;
+                scope: string;
+            }>;
+            deviceVerify: better_auth.StrictEndpoint<"/device", {
+                method: "GET";
+                query: zod.ZodObject<{
+                    user_code: zod.ZodString;
+                }, better_auth.$strip>;
+                error: zod.ZodObject<{
+                    error: zod.ZodEnum<{
+                        invalid_request: "invalid_request";
+                    }>;
+                    error_description: zod.ZodString;
+                }, better_auth.$strip>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                user_code: {
+                                                    type: string;
+                                                    description: string;
+                                                };
+                                                status: {
+                                                    type: string;
+                                                    enum: string[];
+                                                    description: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            }, {
+                user_code: string;
+                status: string;
+            }>;
+            deviceApprove: better_auth.StrictEndpoint<"/device/approve", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    userCode: zod.ZodString;
+                }, better_auth.$strip>;
+                error: zod.ZodObject<{
+                    error: zod.ZodEnum<{
+                        invalid_request: "invalid_request";
+                        expired_token: "expired_token";
+                        device_code_already_processed: "device_code_already_processed";
+                    }>;
+                    error_description: zod.ZodString;
+                }, better_auth.$strip>;
+                requireHeaders: true;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            }, {
+                success: boolean;
+            }>;
+            deviceDeny: better_auth.StrictEndpoint<"/device/deny", {
+                method: "POST";
+                body: zod.ZodObject<{
+                    userCode: zod.ZodString;
+                }, better_auth.$strip>;
+                error: zod.ZodObject<{
+                    error: zod.ZodEnum<{
+                        invalid_request: "invalid_request";
+                        expired_token: "expired_token";
+                    }>;
+                    error_description: zod.ZodString;
+                }, better_auth.$strip>;
+                metadata: {
+                    openapi: {
+                        description: string;
+                        responses: {
+                            200: {
+                                description: string;
+                                content: {
+                                    "application/json": {
+                                        schema: {
+                                            type: "object";
+                                            properties: {
+                                                success: {
+                                                    type: string;
+                                                };
+                                            };
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
+                };
+            } & {
+                use: any[];
+            }, {
+                success: boolean;
+            }>;
+        };
+        $ERROR_CODES: {
+            readonly INVALID_DEVICE_CODE: "Invalid device code";
+            readonly EXPIRED_DEVICE_CODE: "Device code has expired";
+            readonly EXPIRED_USER_CODE: "User code has expired";
+            readonly AUTHORIZATION_PENDING: "Authorization pending";
+            readonly ACCESS_DENIED: "Access denied";
+            readonly INVALID_USER_CODE: "Invalid user code";
+            readonly DEVICE_CODE_ALREADY_PROCESSED: "Device code already processed";
+            readonly POLLING_TOO_FREQUENTLY: "Polling too frequently";
+            readonly USER_NOT_FOUND: "User not found";
+            readonly FAILED_TO_CREATE_SESSION: "Failed to create session";
+            readonly INVALID_DEVICE_CODE_STATUS: "Invalid device code status";
+            readonly AUTHENTICATION_REQUIRED: "Authentication required";
+        };
     }];
 }>;
 declare const auth: ReturnType<typeof createAuth>;

package/dist/auth/auth.js

@@ -1,11 +1,11 @@
 import { generateId } from '../chunk-VXHL7CJY.js';
 import { env } from '../chunk-ZIXAWYZI.js';
-import { ssoProvider } from '../chunk-GENLXHZ4.js';
+import { ssoProvider } from '../chunk-XL55SHQM.js';
 import { ownerRole, adminRole, memberRole, ac } from '../chunk-JNBVHWXX.js';
 import { sso } from '@better-auth/sso';
 import { betterAuth } from 'better-auth';
 import { drizzleAdapter } from 'better-auth/adapters/drizzle';
-import { organization } from 'better-auth/plugins';
+import { bearer, organization, deviceAuthorization } from 'better-auth/plugins';
 import { eq } from 'drizzle-orm';
 
 function extractCookieDomain(baseURL) {
@@ -98,6 +98,7 @@ function createAuth(config) {
       env.INKEEP_AGENTS_MANAGE_API_URL
     ].filter((origin) => typeof origin === "string" && origin.length > 0),
     plugins: [
+      bearer(),
       sso(),
       organization({
         allowUserToCreateOrganization: true,
@@ -115,6 +116,15 @@ function createAuth(config) {
             invitationId: data.id
           });
         }
+      }),
+      deviceAuthorization({
+        verificationUri: "/device",
+        expiresIn: "60m",
+        // 30 minutes
+        interval: "5s",
+        // 5 second polling interval
+        userCodeLength: 8
+        // e.g., "ABCD-EFGH"
       })
     ]
   });

package/dist/chunk-4VNS5WPM.js

@@ -0,0 +1,37 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+export { __commonJS, __export, __require, __toESM };

package/dist/{chunk-DW4DNYUS.js → chunk-BZOLMLKX.js}

@@ -1,5 +1,5 @@
-import { schema_exports, projects } from './chunk-LH6OJIIM.js';
-import { organization } from './chunk-GENLXHZ4.js';
+import { schema_exports, projects } from './chunk-LI7GCYW2.js';
+import { organization } from './chunk-XL55SHQM.js';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 import { PGlite } from '@electric-sql/pglite';

package/dist/{chunk-CWAFZVRI.js → chunk-FGS57CQI.js}

@@ -1,4 +1,4 @@
-import { AgentWithinContextOfProjectSchema, resourceIdSchema, MAX_ID_LENGTH } from './chunk-UK63CULA.js';
+import { AgentWithinContextOfProjectSchema, resourceIdSchema, MAX_ID_LENGTH } from './chunk-RZN5SMF6.js';
 import { z } from '@hono/zod-openapi';
 
 // src/validation/cycleDetection.ts

package/dist/{chunk-LH6OJIIM.js → chunk-LI7GCYW2.js}

@@ -1,5 +1,5 @@
-import { verification, user, ssoProvider, session, organization, member, invitation, account } from './chunk-GENLXHZ4.js';
-import { __export } from './chunk-SIAA4J6H.js';
+import { verification, user, ssoProvider, session, organization, member, invitation, deviceCode, account } from './chunk-XL55SHQM.js';
+import { __export } from './chunk-4VNS5WPM.js';
 import { relations } from 'drizzle-orm';
 import { pgTable, varchar, text, timestamp, jsonb, primaryKey, foreignKey, integer, index, unique } from 'drizzle-orm/pg-core';
 
@@ -24,6 +24,7 @@ __export(schema_exports, {
   credentialReferencesRelations: () => credentialReferencesRelations,
   dataComponents: () => dataComponents,
   dataComponentsRelations: () => dataComponentsRelations,
+  deviceCode: () => deviceCode,
   externalAgents: () => externalAgents,
   externalAgentsRelations: () => externalAgentsRelations,
   functionTools: () => functionTools,

package/dist/{chunk-S4XQEAAF.js → chunk-PKGWDXDS.js}

@@ -1,8 +1,8 @@
 import { DEFAULT_NANGO_STORE_ID } from './chunk-3OPS2LN5.js';
 import { getLogger } from './chunk-DN4B564Y.js';
 import { CredentialStoreType } from './chunk-YFHT5M2R.js';
+import { __require } from './chunk-4VNS5WPM.js';
 import { z } from '@hono/zod-openapi';
-import { Nango } from '@nangohq/node';
 
 // src/credential-stores/CredentialStoreRegistry.ts
 var CredentialStoreRegistry = class {
@@ -99,13 +99,6 @@ var KeyChainStore = class {
         'keytar'
       )).default;
       this.keytarAvailable = true;
-      this.logger.info(
-        {
-          storeId: this.id,
-          service: this.service
-        },
-        "Keytar initialized successfully"
-      );
     } catch (error) {
       this.logger.warn(
         {
@@ -352,6 +345,28 @@ var InMemoryCredentialStore = class {
   }
 };
 var logger = getLogger("nango-credential-store");
+var nangoModule = null;
+function isNangoAvailable() {
+  try {
+    __require.resolve("@nangohq/node");
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function loadNangoModule() {
+  if (nangoModule) {
+    return nangoModule;
+  }
+  try {
+    nangoModule = await import('./dist-TUQUTLPM.js');
+    return nangoModule;
+  } catch {
+    throw new Error(
+      "Nango is not installed. To use Nango credential store, install it with: npm install @nangohq/node @nangohq/types"
+    );
+  }
+}
 var CredentialKeySchema = z.object({
   connectionId: z.string().min(1, "connectionId must be a non-empty string"),
   providerConfigKey: z.string().min(1, "providerConfigKey must be a non-empty string"),
@@ -391,14 +406,24 @@ var NangoCredentialStore = class {
   id;
   type = CredentialStoreType.nango;
   nangoConfig;
-  nangoClient;
+  nangoClient = null;
   constructor(id, config) {
     this.id = id;
     this.nangoConfig = config;
+  }
+  /**
+   * Initialize Nango client lazily
+   */
+  async getNangoClient() {
+    if (this.nangoClient) {
+      return this.nangoClient;
+    }
+    const { Nango } = await loadNangoModule();
     this.nangoClient = new Nango({
       secretKey: this.nangoConfig.secretKey,
       host: this.nangoConfig.apiUrl
     });
+    return this.nangoClient;
   }
   getAccessToken(credentials) {
     const { type } = credentials;
@@ -486,7 +511,8 @@ var NangoCredentialStore = class {
    */
   async fetchNangoIntegration(uniqueKey) {
     try {
-      const response = await this.nangoClient.getIntegration(
+      const nangoClient = await this.getNangoClient();
+      const response = await nangoClient.getIntegration(
         { uniqueKey },
         { include: ["credentials"] }
       );
@@ -528,7 +554,8 @@ var NangoCredentialStore = class {
     try {
       let integration;
       try {
-        const response2 = await this.nangoClient.createIntegration({
+        const nangoClient = await this.getNangoClient();
+        const response2 = await nangoClient.createIntegration({
           provider,
           unique_key: uniqueKey,
           display_name: displayName
@@ -594,7 +621,8 @@ var NangoCredentialStore = class {
     providerConfigKey
   }) {
     try {
-      const nangoConnection = await this.nangoClient.getConnection(providerConfigKey, connectionId);
+      const nangoClient = await this.getNangoClient();
+      const nangoConnection = await nangoClient.getConnection(providerConfigKey, connectionId);
       const tokenAndCredentials = this.getAccessToken(nangoConnection.credentials) ?? {};
       const credentialData = {
         ...tokenAndCredentials,
@@ -691,7 +719,8 @@ var NangoCredentialStore = class {
         return false;
       }
       const { connectionId, providerConfigKey } = parsedKey;
-      await this.nangoClient.deleteConnection(providerConfigKey, connectionId);
+      const nangoClient = await this.getNangoClient();
+      await nangoClient.deleteConnection(providerConfigKey, connectionId);
       return true;
     } catch (error) {
       logger.error(
@@ -709,6 +738,12 @@ var NangoCredentialStore = class {
    * Check if the credential store is available and functional
    */
   async checkAvailability() {
+    if (!isNangoAvailable()) {
+      return {
+        available: false,
+        reason: "Nango is not installed. Install with: npm install @nangohq/node @nangohq/types"
+      };
+    }
     if (!this.nangoConfig.secretKey) {
       return {
         available: false,
@@ -727,6 +762,11 @@ var NangoCredentialStore = class {
   }
 };
 function createNangoCredentialStore(id, config) {
+  if (!isNangoAvailable()) {
+    throw new Error(
+      "Nango is not installed. To use Nango credential store, install it with: npm install @nangohq/node @nangohq/types"
+    );
+  }
   const nangoSecretKey = config?.secretKey || process.env.NANGO_SECRET_KEY;
   if (!nangoSecretKey || nangoSecretKey === "your_nango_secret_key" || nangoSecretKey.includes("mock")) {
     throw new Error(
@@ -744,13 +784,17 @@ function createNangoCredentialStore(id, config) {
 function createDefaultCredentialStores() {
   const stores = [];
   stores.push(new InMemoryCredentialStore("memory-default"));
-  if (process.env.NANGO_SECRET_KEY) {
-    stores.push(
-      createNangoCredentialStore(DEFAULT_NANGO_STORE_ID, {
-        apiUrl: process.env.NANGO_SERVER_URL || "https://api.nango.dev",
-        secretKey: process.env.NANGO_SECRET_KEY
-      })
-    );
+  if (process.env.NANGO_SECRET_KEY && isNangoAvailable()) {
+    try {
+      stores.push(
+        createNangoCredentialStore(DEFAULT_NANGO_STORE_ID, {
+          apiUrl: process.env.NANGO_SERVER_URL || "https://api.nango.dev",
+          secretKey: process.env.NANGO_SECRET_KEY
+        })
+      );
+    } catch (error) {
+      console.warn("Failed to create Nango store:", error instanceof Error ? error.message : error);
+    }
   }
   try {
     stores.push(createKeyChainStore("keychain-default"));
@@ -763,4 +807,4 @@ function createDefaultCredentialStores() {
   return stores;
 }
 
-export { CredentialStoreRegistry, InMemoryCredentialStore, KeyChainStore, NangoCredentialStore, createDefaultCredentialStores, createKeyChainStore, createNangoCredentialStore };
+export { CredentialStoreRegistry, InMemoryCredentialStore, KeyChainStore, NangoCredentialStore, createDefaultCredentialStores, createKeyChainStore, createNangoCredentialStore, isNangoAvailable };

package/dist/{chunk-UK63CULA.js → chunk-RZN5SMF6.js}

@@ -1,4 +1,4 @@
-import { subAgents, subAgentRelations, agents, tasks, taskRelations, conversations, messages, contextCache, dataComponents, subAgentDataComponents, artifactComponents, subAgentArtifactComponents, externalAgents, apiKeys, credentialReferences, tools, functionTools, functions, contextConfigs, subAgentToolRelations, subAgentExternalAgentRelations, subAgentTeamAgentRelations, ledgerArtifacts, projects } from './chunk-LH6OJIIM.js';
+import { subAgents, subAgentRelations, agents, tasks, taskRelations, conversations, messages, contextCache, dataComponents, subAgentDataComponents, artifactComponents, subAgentArtifactComponents, externalAgents, apiKeys, credentialReferences, tools, functionTools, functions, contextConfigs, subAgentToolRelations, subAgentExternalAgentRelations, subAgentTeamAgentRelations, ledgerArtifacts, projects } from './chunk-LI7GCYW2.js';
 import { schemaValidationDefaults } from './chunk-Z64UK4CA.js';
 import { VALID_RELATION_TYPES, MCPTransportType, TOOL_STATUS_VALUES, CredentialStoreType, MCPServerType } from './chunk-YFHT5M2R.js';
 import { z } from '@hono/zod-openapi';