@inkeep/agents-core 0.41.2 → 0.43.0

package/dist/utils/trigger-auth.d.ts

@@ -0,0 +1,85 @@
+import { SignatureVerificationConfig, TriggerAuthHeaderInputSchema, TriggerAuthHeaderStoredSchema, TriggerAuthenticationStoredSchema } from "../validation/schemas.js";
+import { Context } from "hono";
+import { z } from "zod";
+
+//#region src/utils/trigger-auth.d.ts
+type TriggerAuthHeaderInput = z.infer<typeof TriggerAuthHeaderInputSchema>;
+type TriggerAuthHeaderStored = z.infer<typeof TriggerAuthHeaderStoredSchema>;
+type TriggerAuthenticationStored = z.infer<typeof TriggerAuthenticationStoredSchema>;
+interface TriggerAuthResult {
+  success: boolean;
+  status?: number;
+  message?: string;
+}
+interface HashedHeaderValue {
+  valueHash: string;
+  valuePrefix: string;
+}
+/**
+ * Hash a header value using scrypt for secure storage.
+ * Returns the hash and a prefix for display purposes.
+ *
+ * @param value - The plaintext header value to hash
+ * @returns Object containing valueHash (for storage) and valuePrefix (for display)
+ */
+declare function hashTriggerHeaderValue(value: string): Promise<HashedHeaderValue>;
+/**
+ * Validate a header value against its stored hash using timing-safe comparison.
+ *
+ * @param value - The plaintext header value from the incoming request
+ * @param storedHash - The hash stored in the database
+ * @returns True if the value matches the hash
+ */
+declare function validateTriggerHeaderValue(value: string, storedHash: string): Promise<boolean>;
+/**
+ * Transform authentication input (plaintext values) to stored format (hashed values).
+ * Used when creating or updating triggers.
+ *
+ * @param headers - Array of header inputs with plaintext values
+ * @returns Array of headers with hashed values for storage
+ */
+declare function hashAuthenticationHeaders(headers: TriggerAuthHeaderInput[]): Promise<TriggerAuthHeaderStored[]>;
+/**
+ * Verifies incoming webhook requests using the configured authentication headers.
+ * Each configured header must be present and match its expected value (via hash comparison).
+ *
+ * @param c - Hono context containing the request headers
+ * @param authentication - Trigger authentication configuration with hashed header values
+ * @returns TriggerAuthResult indicating success/failure with appropriate HTTP status
+ */
+declare function verifyTriggerAuth(c: Context, authentication?: TriggerAuthenticationStored | null): Promise<TriggerAuthResult>;
+/**
+ * Error codes for signature verification failures.
+ */
+type SignatureVerificationErrorCode = 'MISSING_SIGNATURE' | 'MISSING_COMPONENT' | 'INVALID_SIGNATURE_FORMAT' | 'SIGNATURE_MISMATCH';
+interface SignatureVerificationResult {
+  success: boolean;
+  errorCode?: SignatureVerificationErrorCode;
+  status?: number;
+  message?: string;
+}
+/**
+ * Verifies webhook signature using flexible, provider-agnostic configuration.
+ * Supports GitHub, Slack, Zendesk, Stripe and other webhook signature schemes.
+ *
+ * SECURITY: Uses crypto.timingSafeEqual() for all signature comparisons to prevent timing attacks.
+ *
+ * @param c - Hono context containing request headers, query, and body
+ * @param config - Signature verification configuration
+ * @param signingSecret - HMAC signing secret
+ * @param body - Raw request body as string
+ * @returns SignatureVerificationResult with success status and error details
+ *
+ * @example
+ * // GitHub webhook verification
+ * const result = verifySignatureWithConfig(c, {
+ *   algorithm: 'sha256',
+ *   encoding: 'hex',
+ *   signature: { source: 'header', key: 'x-hub-signature-256', prefix: 'sha256=' },
+ *   signedComponents: [{ source: 'body', key: '@' }],
+ *   componentJoin: { strategy: 'concatenate', separator: '' }
+ * }, secret, body);
+ */
+declare function verifySignatureWithConfig(c: Context, config: SignatureVerificationConfig, signingSecret: string, body: string): SignatureVerificationResult;
+//#endregion
+export { HashedHeaderValue, SignatureVerificationErrorCode, SignatureVerificationResult, TriggerAuthResult, hashAuthenticationHeaders, hashTriggerHeaderValue, validateTriggerHeaderValue, verifySignatureWithConfig, verifyTriggerAuth };

package/dist/utils/trigger-auth.js

@@ -0,0 +1,233 @@
+import { searchJMESPath } from "./jmespath-utils.js";
+import { createHmac, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+
+//#region src/utils/trigger-auth.ts
+const scryptAsync = promisify(scrypt);
+const SALT_LENGTH = 32;
+const KEY_LENGTH = 64;
+const VALUE_PREFIX_LENGTH = 8;
+/**
+* Hash a header value using scrypt for secure storage.
+* Returns the hash and a prefix for display purposes.
+*
+* @param value - The plaintext header value to hash
+* @returns Object containing valueHash (for storage) and valuePrefix (for display)
+*/
+async function hashTriggerHeaderValue(value) {
+	const salt = randomBytes(SALT_LENGTH);
+	const hashedBuffer = await scryptAsync(value, salt, KEY_LENGTH);
+	return {
+		valueHash: Buffer.concat([salt, hashedBuffer]).toString("base64"),
+		valuePrefix: value.substring(0, VALUE_PREFIX_LENGTH)
+	};
+}
+/**
+* Validate a header value against its stored hash using timing-safe comparison.
+*
+* @param value - The plaintext header value from the incoming request
+* @param storedHash - The hash stored in the database
+* @returns True if the value matches the hash
+*/
+async function validateTriggerHeaderValue(value, storedHash) {
+	try {
+		const combined = Buffer.from(storedHash, "base64");
+		const salt = combined.subarray(0, SALT_LENGTH);
+		return timingSafeEqual(combined.subarray(SALT_LENGTH), await scryptAsync(value, salt, KEY_LENGTH));
+	} catch {
+		return false;
+	}
+}
+/**
+* Transform authentication input (plaintext values) to stored format (hashed values).
+* Used when creating or updating triggers.
+*
+* @param headers - Array of header inputs with plaintext values
+* @returns Array of headers with hashed values for storage
+*/
+async function hashAuthenticationHeaders(headers) {
+	return Promise.all(headers.map(async (header) => {
+		const { valueHash, valuePrefix } = await hashTriggerHeaderValue(header.value);
+		return {
+			name: header.name,
+			valueHash,
+			valuePrefix
+		};
+	}));
+}
+/**
+* Verifies incoming webhook requests using the configured authentication headers.
+* Each configured header must be present and match its expected value (via hash comparison).
+*
+* @param c - Hono context containing the request headers
+* @param authentication - Trigger authentication configuration with hashed header values
+* @returns TriggerAuthResult indicating success/failure with appropriate HTTP status
+*/
+async function verifyTriggerAuth(c, authentication) {
+	if (!authentication || !authentication.headers || authentication.headers.length === 0) return { success: true };
+	for (const header of authentication.headers) {
+		const headerName = header.name.toLowerCase();
+		const actualValue = c.req.header(headerName);
+		if (!actualValue) return {
+			success: false,
+			status: 401,
+			message: `Missing authentication header: ${header.name}`
+		};
+		if (!await validateTriggerHeaderValue(actualValue, header.valueHash)) return {
+			success: false,
+			status: 403,
+			message: `Invalid value for header: ${header.name}`
+		};
+	}
+	return { success: true };
+}
+/**
+* Extracts the signature from the request based on configuration.
+* Supports extraction from headers, query parameters, or body via JMESPath.
+* Optionally strips prefix and applies regex extraction.
+*
+* @param c - Hono context
+* @param config - Signature verification configuration
+* @param body - Raw request body as string
+* @returns Extracted signature string or null if not found
+*/
+function extractSignature(c, config, body) {
+	const { signature } = config;
+	const caseSensitive = config.validation?.headerCaseSensitive ?? false;
+	let value;
+	if (signature.source === "header") {
+		const headerKey = caseSensitive ? signature.key : signature.key.toLowerCase();
+		value = c.req.header(headerKey);
+	} else if (signature.source === "query") value = c.req.query(signature.key);
+	else if (signature.source === "body") try {
+		value = searchJMESPath(JSON.parse(body), signature.key);
+	} catch {
+		return null;
+	}
+	if (!value) return null;
+	if (signature.prefix && value.startsWith(signature.prefix)) value = value.slice(signature.prefix.length);
+	if (signature.regex) try {
+		const match = value.match(new RegExp(signature.regex));
+		if (match?.[1]) value = match[1];
+		else return null;
+	} catch {
+		return null;
+	}
+	return value;
+}
+/**
+* Extracts a single signed component from the request.
+*
+* @param c - Hono context
+* @param component - Component configuration
+* @param body - Raw request body as string
+* @param caseSensitive - Whether header names should be case-sensitive
+* @returns Extracted component value or null if required and not found
+*/
+function extractComponent(c, component, body, caseSensitive) {
+	let value;
+	if (component.source === "literal") value = component.value ?? "";
+	else if (component.source === "header") {
+		if (!component.key) return component.required ? null : "";
+		const headerKey = caseSensitive ? component.key : component.key.toLowerCase();
+		value = c.req.header(headerKey);
+	} else if (component.source === "body") if (!component.key) value = body;
+	else try {
+		value = searchJMESPath(JSON.parse(body), component.key);
+	} catch {
+		return component.required ? null : "";
+	}
+	if (value === void 0 || value === null) return component.required ? null : "";
+	value = String(value);
+	if (component.regex) try {
+		const match = value.match(new RegExp(component.regex));
+		if (match?.[1]) value = match[1];
+		else return component.required ? null : "";
+	} catch {
+		return component.required ? null : "";
+	}
+	return value;
+}
+/**
+* Verifies webhook signature using flexible, provider-agnostic configuration.
+* Supports GitHub, Slack, Zendesk, Stripe and other webhook signature schemes.
+*
+* SECURITY: Uses crypto.timingSafeEqual() for all signature comparisons to prevent timing attacks.
+*
+* @param c - Hono context containing request headers, query, and body
+* @param config - Signature verification configuration
+* @param signingSecret - HMAC signing secret
+* @param body - Raw request body as string
+* @returns SignatureVerificationResult with success status and error details
+*
+* @example
+* // GitHub webhook verification
+* const result = verifySignatureWithConfig(c, {
+*   algorithm: 'sha256',
+*   encoding: 'hex',
+*   signature: { source: 'header', key: 'x-hub-signature-256', prefix: 'sha256=' },
+*   signedComponents: [{ source: 'body', key: '@' }],
+*   componentJoin: { strategy: 'concatenate', separator: '' }
+* }, secret, body);
+*/
+function verifySignatureWithConfig(c, config, signingSecret, body) {
+	const caseSensitive = config.validation?.headerCaseSensitive ?? false;
+	const allowEmptyBody = config.validation?.allowEmptyBody ?? true;
+	const normalizeUnicode = config.validation?.normalizeUnicode ?? false;
+	const signature = extractSignature(c, config, body);
+	if (!signature) return {
+		success: false,
+		errorCode: "MISSING_SIGNATURE",
+		status: 401,
+		message: "Missing or invalid signature"
+	};
+	const components = [];
+	for (const componentConfig of config.signedComponents) {
+		const componentValue = extractComponent(c, componentConfig, body, caseSensitive);
+		if (componentValue === null) return {
+			success: false,
+			errorCode: "MISSING_COMPONENT",
+			status: 400,
+			message: "Missing required signed component"
+		};
+		components.push(componentValue);
+	}
+	let signedData = components.join(config.componentJoin.separator);
+	if (normalizeUnicode) signedData = signedData.normalize("NFC");
+	if (!allowEmptyBody && signedData === "") return {
+		success: false,
+		errorCode: "MISSING_COMPONENT",
+		status: 400,
+		message: "Empty body not allowed"
+	};
+	const hmac = createHmac(config.algorithm, signingSecret);
+	hmac.update(signedData);
+	const expectedSignature = hmac.digest(config.encoding);
+	try {
+		const signatureBuffer = Buffer.from(signature, config.encoding);
+		const expectedBuffer = Buffer.from(expectedSignature, config.encoding);
+		if (signatureBuffer.length !== expectedBuffer.length) return {
+			success: false,
+			errorCode: "SIGNATURE_MISMATCH",
+			status: 403,
+			message: "Invalid signature"
+		};
+		if (!timingSafeEqual(signatureBuffer, expectedBuffer)) return {
+			success: false,
+			errorCode: "SIGNATURE_MISMATCH",
+			status: 403,
+			message: "Invalid signature"
+		};
+		return { success: true };
+	} catch {
+		return {
+			success: false,
+			errorCode: "INVALID_SIGNATURE_FORMAT",
+			status: 403,
+			message: "Invalid signature format"
+		};
+	}
+}
+
+//#endregion
+export { hashAuthenticationHeaders, hashTriggerHeaderValue, validateTriggerHeaderValue, verifySignatureWithConfig, verifyTriggerAuth };

package/dist/validation/agentFull.js

@@ -53,10 +53,8 @@ function validateAgentRelationships(agentData) {
 		if (subAgent.canTransferTo && Array.isArray(subAgent.canTransferTo)) {
 			for (const targetId of subAgent.canTransferTo) if (!availableAgentIds.has(targetId)) errors.push(`Agent '${subAgentId}' has transfer target '${targetId}' that doesn't exist in agent`);
 		}
-		if (subAgent.canDelegateTo && Array.isArray(subAgent.canDelegateTo)) for (const targetItem of subAgent.canDelegateTo) {
-			console.log("targetItem", targetItem);
-			if (typeof targetItem === "string") {
-				console.log("targetItem is string", targetItem);
+		if (subAgent.canDelegateTo && Array.isArray(subAgent.canDelegateTo)) {
+			for (const targetItem of subAgent.canDelegateTo) if (typeof targetItem === "string") {
 				if (!availableAgentIds.has(targetItem) && !availableExternalAgentIds.has(targetItem)) errors.push(`Agent '${subAgentId}' has delegation target '${targetItem}' that doesn't exist in agent`);
 			}
 		}

package/dist/validation/dolt-schemas.d.ts

@@ -0,0 +1,49 @@
+import { z } from "@hono/zod-openapi";
+
+//#region src/validation/dolt-schemas.d.ts
+declare const BranchNameSchema: z.ZodString;
+declare const CreateBranchRequestSchema: z.ZodObject<{
+  name: z.ZodString;
+  from: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+declare const BranchInfoSchema: z.ZodObject<{
+  baseName: z.ZodString;
+  fullName: z.ZodString;
+  hash: z.ZodString;
+}, z.core.$strip>;
+declare const BranchResponseSchema: z.ZodObject<{
+  data: z.ZodObject<{
+    baseName: z.ZodString;
+    fullName: z.ZodString;
+    hash: z.ZodString;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+declare const BranchListResponseSchema: z.ZodObject<{
+  data: z.ZodArray<z.ZodObject<{
+    baseName: z.ZodString;
+    fullName: z.ZodString;
+    hash: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const BranchNameParamsSchema: z.ZodObject<{
+  tenantId: z.ZodString;
+  projectId: z.ZodString;
+  branchName: z.ZodString;
+}, z.core.$strip>;
+declare const ResolvedRefSchema: z.ZodObject<{
+  type: z.ZodEnum<{
+    commit: "commit";
+    tag: "tag";
+    branch: "branch";
+  }>;
+  name: z.ZodString;
+  hash: z.ZodString;
+}, z.core.$strip>;
+type ResolvedRef = z.infer<typeof ResolvedRefSchema>;
+type CreateBranchRequest = z.infer<typeof CreateBranchRequestSchema>;
+type BranchInfo = z.infer<typeof BranchInfoSchema>;
+type BranchResponse = z.infer<typeof BranchResponseSchema>;
+type BranchListResponse = z.infer<typeof BranchListResponseSchema>;
+type BranchNameParams = z.infer<typeof BranchNameParamsSchema>;
+//#endregion
+export { BranchInfo, BranchInfoSchema, BranchListResponse, BranchListResponseSchema, BranchNameParams, BranchNameParamsSchema, BranchNameSchema, BranchResponse, BranchResponseSchema, CreateBranchRequest, CreateBranchRequestSchema, ResolvedRef, ResolvedRefSchema };

package/dist/validation/dolt-schemas.js

@@ -0,0 +1,44 @@
+import { z } from "@hono/zod-openapi";
+
+//#region src/validation/dolt-schemas.ts
+const BranchNameSchema = z.string().min(1, "Branch name cannot be empty").max(255, "Branch name too long").regex(/^[a-zA-Z0-9\-_./]+$/, { message: "Branch name can only contain letters, numbers, hyphens, underscores, dots, and slashes" }).openapi({
+	example: "feature-x",
+	description: "Name of the branch"
+});
+const CreateBranchRequestSchema = z.object({
+	name: BranchNameSchema,
+	from: z.string().optional().describe("Branch or commit to create from. Defaults to tenant main branch.")
+}).openapi("CreateBranchRequest");
+const BranchInfoSchema = z.object({
+	baseName: z.string().describe("User-provided branch name"),
+	fullName: z.string().describe("Full namespaced branch name"),
+	hash: z.string().describe("Current commit hash of the branch")
+}).openapi("BranchInfo");
+const BranchResponseSchema = z.object({ data: BranchInfoSchema }).openapi("BranchResponse");
+const BranchListResponseSchema = z.object({ data: z.array(BranchInfoSchema) }).openapi("BranchListResponse");
+const BranchNameParamsSchema = z.object({
+	tenantId: z.string().openapi({ param: {
+		name: "tenantId",
+		in: "path"
+	} }),
+	projectId: z.string().openapi({ param: {
+		name: "projectId",
+		in: "path"
+	} }),
+	branchName: z.string().openapi({ param: {
+		name: "branchName",
+		in: "path"
+	} })
+}).openapi("BranchNameParams");
+const ResolvedRefSchema = z.object({
+	type: z.enum([
+		"commit",
+		"tag",
+		"branch"
+	]).describe("The type of ref"),
+	name: z.string().describe("The name of the ref (branch name, tag name, or commit hash)"),
+	hash: z.string().describe("The commit hash this ref resolves to")
+}).openapi("ResolvedRef");
+
+//#endregion
+export { BranchInfoSchema, BranchListResponseSchema, BranchNameParamsSchema, BranchNameSchema, BranchResponseSchema, CreateBranchRequestSchema, ResolvedRefSchema };

package/dist/validation/drizzle-schema-helpers.d.ts

@@ -1,5 +1,5 @@
 import { z } from "@hono/zod-openapi";
-import * as drizzle_zod141 from "drizzle-zod";
+import * as drizzle_zod15 from "drizzle-zod";
 import { AnySQLiteTable } from "drizzle-orm/sqlite-core";
 
 //#region src/validation/drizzle-schema-helpers.d.ts
@@ -22,8 +22,8 @@ declare const resourceIdSchema: z.ZodString;
 declare function createResourceIdSchema(description: string, options?: {
   example?: string;
 }): z.ZodString;
-declare function createSelectSchemaWithModifiers<T extends AnySQLiteTable>(table: T, overrides?: Partial<Record<keyof T['_']['columns'], (schema: z.ZodTypeAny) => z.ZodTypeAny>>): drizzle_zod141.BuildSchema<"select", T["_"]["columns"], drizzle_zod141.BuildRefine<T["_"]["columns"], undefined>, undefined>;
-declare function createInsertSchemaWithModifiers<T extends AnySQLiteTable>(table: T, overrides?: Partial<Record<keyof T['_']['columns'], (schema: z.ZodTypeAny) => z.ZodTypeAny>>): drizzle_zod141.BuildSchema<"insert", T["_"]["columns"], drizzle_zod141.BuildRefine<Pick<T["_"]["columns"], keyof T["$inferInsert"]>, undefined>, undefined>;
+declare function createSelectSchemaWithModifiers<T extends AnySQLiteTable>(table: T, overrides?: Partial<Record<keyof T['_']['columns'], (schema: z.ZodTypeAny) => z.ZodTypeAny>>): drizzle_zod15.BuildSchema<"select", T["_"]["columns"], drizzle_zod15.BuildRefine<T["_"]["columns"], undefined>, undefined>;
+declare function createInsertSchemaWithModifiers<T extends AnySQLiteTable>(table: T, overrides?: Partial<Record<keyof T['_']['columns'], (schema: z.ZodTypeAny) => z.ZodTypeAny>>): drizzle_zod15.BuildSchema<"insert", T["_"]["columns"], drizzle_zod15.BuildRefine<Pick<T["_"]["columns"], keyof T["$inferInsert"]>, undefined>, undefined>;
 declare const createSelectSchema: typeof createSelectSchemaWithModifiers;
 declare const createInsertSchema: typeof createInsertSchemaWithModifiers;
 /**
@@ -38,27 +38,5 @@ declare const createInsertSchema: typeof createInsertSchemaWithModifiers;
  * The schema shape itself is not modified, but the field schemas are registered.
  */
 declare function registerFieldSchemas<T extends z.ZodObject<any>>(schema: T): T;
-/**
- * Wrapper for .partial() that registers the resulting schema and its fields in the global registry.
- * This function ensures that field schemas are properly registered and configured with OpenAPI metadata.
- */
-declare function partialWithRegistry<T extends z.ZodObject<any>>(schema: T, metadata?: {
-  description?: string;
-  [key: string]: unknown;
-}): T;
-/**
- * Wrapper for .omit() that registers the resulting schema and its fields in the global registry
- */
-declare function omitWithRegistry<T extends z.ZodObject<any>>(schema: T, keys: z.ZodObject<any>['shape'], metadata?: {
-  description?: string;
-  [key: string]: unknown;
-}): T;
-/**
- * Wrapper for .extend() that registers the resulting schema and its fields in the global registry
- */
-declare function extendWithRegistry<T extends z.ZodObject<any>>(schema: T, shape: z.ZodRawShape, metadata?: {
-  description?: string;
-  [key: string]: unknown;
-}): T;
 //#endregion
-export { MAX_ID_LENGTH, MIN_ID_LENGTH, URL_SAFE_ID_PATTERN, createInsertSchema, createResourceIdSchema, createSelectSchema, extendWithRegistry, omitWithRegistry, partialWithRegistry, registerFieldSchemas, resourceIdSchema };
+export { MAX_ID_LENGTH, MIN_ID_LENGTH, URL_SAFE_ID_PATTERN, createInsertSchema, createResourceIdSchema, createSelectSchema, registerFieldSchemas, resourceIdSchema };

package/dist/validation/drizzle-schema-helpers.js

@@ -31,95 +31,17 @@ function createResourceIdSchema(description, options) {
 	modified.meta({ description });
 	return modified;
 }
-const FIELD_MODIFIERS = {
-	id: (schema) => {
-		const modified = schema.min(MIN_ID_LENGTH).max(MAX_ID_LENGTH).describe("Resource identifier").regex(URL_SAFE_ID_PATTERN, { message: "ID must contain only letters, numbers, hyphens, underscores, and dots" }).openapi({
-			description: "Resource identifier",
-			example: "resource_789"
-		});
-		modified.meta({ description: "Resource identifier" });
-		return modified;
-	},
-	name: (_schema) => {
-		const modified = z.string().describe("Name");
-		modified.meta({ description: "Name" });
-		return modified;
-	},
-	description: (_schema) => {
-		const modified = z.string().describe("Description");
-		modified.meta({ description: "Description" });
-		return modified;
-	},
-	tenantId: (schema) => {
-		const modified = schema.describe("Tenant identifier");
-		modified.meta({ description: "Tenant identifier" });
-		return modified;
-	},
-	projectId: (schema) => {
-		const modified = schema.describe("Project identifier");
-		modified.meta({ description: "Project identifier" });
-		return modified;
-	},
-	agentId: (schema) => {
-		const modified = schema.describe("Agent identifier");
-		modified.meta({ description: "Agent identifier" });
-		return modified;
-	},
-	subAgentId: (schema) => {
-		const modified = schema.describe("Sub-agent identifier");
-		modified.meta({ description: "Sub-agent identifier" });
-		return modified;
-	},
-	createdAt: (schema) => {
-		const modified = schema.describe("Creation timestamp");
-		modified.meta({ description: "Creation timestamp" });
-		return modified;
-	},
-	updatedAt: (schema) => {
-		const modified = schema.describe("Last update timestamp");
-		modified.meta({ description: "Last update timestamp" });
-		return modified;
-	}
-};
 function createSelectSchemaWithModifiers(table, overrides) {
-	const tableColumns = table._?.columns;
-	if (!tableColumns) return createSelectSchema$1(table, overrides);
-	const tableFieldNames = Object.keys(tableColumns);
-	const modifiers = {};
-	for (const fieldName of tableFieldNames) {
-		const fieldNameStr = String(fieldName);
-		if (fieldNameStr in FIELD_MODIFIERS) modifiers[fieldNameStr] = FIELD_MODIFIERS[fieldNameStr];
-	}
-	return createSelectSchema$1(table, {
-		...modifiers,
-		...overrides
-	});
+	if (!table._?.columns) return createSelectSchema$1(table, overrides);
+	throw new Error("Unexpected \"tableColumns\" is defined");
 }
 function createInsertSchemaWithModifiers(table, overrides) {
-	const tableColumns = table._?.columns;
-	if (!tableColumns) return createInsertSchema$1(table, overrides);
-	const tableFieldNames = Object.keys(tableColumns);
-	const modifiers = {};
-	for (const fieldName of tableFieldNames) {
-		const fieldNameStr = String(fieldName);
-		if (fieldNameStr in FIELD_MODIFIERS) modifiers[fieldNameStr] = FIELD_MODIFIERS[fieldNameStr];
-	}
-	return createInsertSchema$1(table, {
-		...modifiers,
-		...overrides
-	});
+	if (!table._?.columns) return createInsertSchema$1(table, overrides);
+	throw new Error("Unexpected \"tableColumns\" is defined");
 }
 const createSelectSchema = createSelectSchemaWithModifiers;
 const createInsertSchema = createInsertSchemaWithModifiers;
 /**
-* Helper function to register a schema in the global registry using .meta() and return it.
-* This ensures metadata persists through transformations.
-*/
-function registerSchema(schema, metadata) {
-	schema.meta(metadata);
-	return schema;
-}
-/**
 * Registers all field schemas in an object schema that match known field names.
 * This ensures metadata persists through transformations like .partial() and .omit().
 * For the 'id' field, also applies full validation constraints via .openapi().
@@ -164,74 +86,6 @@ function registerFieldSchemas(schema) {
 	}
 	return schema;
 }
-/**
-* Wrapper for .partial() that registers the resulting schema and its fields in the global registry.
-* This function ensures that field schemas are properly registered and configured with OpenAPI metadata.
-*/
-function partialWithRegistry(schema, metadata) {
-	const partialSchema = schema.partial();
-	registerFieldSchemas(partialSchema);
-	const shape = partialSchema.shape;
-	const newShape = {};
-	const fieldMetadata = {
-		id: { description: "Resource identifier" },
-		name: { description: "Name" },
-		description: { description: "Description" },
-		tenantId: { description: "Tenant identifier" },
-		projectId: { description: "Project identifier" },
-		agentId: { description: "Agent identifier" },
-		subAgentId: { description: "Sub-agent identifier" },
-		createdAt: { description: "Creation timestamp" },
-		updatedAt: { description: "Last update timestamp" }
-	};
-	for (const [fieldName, fieldSchema] of Object.entries(shape)) {
-		let configuredSchema = fieldSchema;
-		if (fieldName in fieldMetadata) {
-			let innerSchema;
-			const isOptional = configuredSchema instanceof z.ZodOptional;
-			if (isOptional) innerSchema = configuredSchema._def.innerType;
-			else innerSchema = configuredSchema;
-			if (fieldName === "id" && innerSchema instanceof z.ZodString) {
-				const configuredId = innerSchema.min(MIN_ID_LENGTH).max(MAX_ID_LENGTH).describe("Resource identifier").regex(URL_SAFE_ID_PATTERN, { message: "ID must contain only letters, numbers, hyphens, underscores, and dots" }).openapi({
-					description: "Resource identifier",
-					minLength: MIN_ID_LENGTH,
-					maxLength: MAX_ID_LENGTH,
-					pattern: URL_SAFE_ID_PATTERN.source,
-					example: "resource_789"
-				});
-				configuredId.meta({ description: "Resource identifier" });
-				configuredSchema = isOptional ? configuredId.optional() : configuredId;
-			} else if (innerSchema instanceof z.ZodString) {
-				const configuredField = innerSchema.describe(fieldMetadata[fieldName].description).openapi({ description: fieldMetadata[fieldName].description });
-				configuredField.meta(fieldMetadata[fieldName]);
-				configuredSchema = isOptional ? configuredField.optional() : configuredField;
-			}
-		}
-		newShape[fieldName] = configuredSchema;
-	}
-	const reconstructedSchema = partialSchema.extend(newShape).partial();
-	registerFieldSchemas(reconstructedSchema);
-	if (metadata) registerSchema(reconstructedSchema, metadata);
-	return reconstructedSchema;
-}
-/**
-* Wrapper for .omit() that registers the resulting schema and its fields in the global registry
-*/
-function omitWithRegistry(schema, keys, metadata) {
-	const omittedSchema = schema.omit(keys);
-	registerFieldSchemas(omittedSchema);
-	if (metadata) registerSchema(omittedSchema, metadata);
-	return omittedSchema;
-}
-/**
-* Wrapper for .extend() that registers the resulting schema and its fields in the global registry
-*/
-function extendWithRegistry(schema, shape, metadata) {
-	const extendedSchema = schema.extend(shape);
-	registerFieldSchemas(extendedSchema);
-	if (metadata) registerSchema(extendedSchema, metadata);
-	return extendedSchema;
-}
 
 //#endregion
-export { MAX_ID_LENGTH, MIN_ID_LENGTH, URL_SAFE_ID_PATTERN, createInsertSchema, createResourceIdSchema, createSelectSchema, extendWithRegistry, omitWithRegistry, partialWithRegistry, registerFieldSchemas, resourceIdSchema };
+export { MAX_ID_LENGTH, MIN_ID_LENGTH, URL_SAFE_ID_PATTERN, createInsertSchema, createResourceIdSchema, createSelectSchema, registerFieldSchemas, resourceIdSchema };