@inkeep/agents-core 0.42.0 → 0.44.0

package/dist/auth/authz/permissions.js

@@ -1,4 +1,4 @@
-import { SpiceDbPermissions, SpiceDbResourceTypes, isAuthzEnabled } from "./config.js";
+import { OrgRoles, SpiceDbProjectPermissions, SpiceDbResourceTypes } from "./config.js";
 import { checkPermission, lookupResources } from "./client.js";
 
 //#region src/auth/authz/permissions.ts
@@ -15,12 +15,11 @@ import { checkPermission, lookupResources } from "./client.js";
 * - Otherwise: checks SpiceDB
 */
 async function canViewProject(params) {
-	if (!isAuthzEnabled(params.tenantId)) return true;
-	if (params.orgRole === "owner" || params.orgRole === "admin") return true;
+	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return true;
 	return checkPermission({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
-		permission: SpiceDbPermissions.VIEW,
+		permission: SpiceDbProjectPermissions.VIEW,
 		subjectType: SpiceDbResourceTypes.USER,
 		subjectId: params.userId
 	});
@@ -33,12 +32,11 @@ async function canViewProject(params) {
 * - Otherwise: checks SpiceDB for use permission
 */
 async function canUseProject(params) {
-	if (!isAuthzEnabled(params.tenantId)) return true;
-	if (params.orgRole === "owner" || params.orgRole === "admin") return true;
+	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return true;
 	return checkPermission({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
-		permission: SpiceDbPermissions.USE,
+		permission: SpiceDbProjectPermissions.USE,
 		subjectType: SpiceDbResourceTypes.USER,
 		subjectId: params.userId
 	});
@@ -51,12 +49,11 @@ async function canUseProject(params) {
 * - Otherwise: checks SpiceDB for edit permission
 */
 async function canEditProject(params) {
-	if (!isAuthzEnabled(params.tenantId)) return params.orgRole === "owner" || params.orgRole === "admin";
-	if (params.orgRole === "owner" || params.orgRole === "admin") return true;
+	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return true;
 	return checkPermission({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
-		permission: SpiceDbPermissions.EDIT,
+		permission: SpiceDbProjectPermissions.EDIT,
 		subjectType: SpiceDbResourceTypes.USER,
 		subjectId: params.userId
 	});
@@ -69,11 +66,10 @@ async function canEditProject(params) {
 * - Otherwise: uses SpiceDB LookupResources
 */
 async function listAccessibleProjectIds(params) {
-	if (!isAuthzEnabled(params.tenantId)) return "all";
-	if (params.orgRole === "owner" || params.orgRole === "admin") return "all";
+	if (params.orgRole === OrgRoles.OWNER || params.orgRole === OrgRoles.ADMIN) return "all";
 	return lookupResources({
 		resourceType: SpiceDbResourceTypes.PROJECT,
-		permission: SpiceDbPermissions.VIEW,
+		permission: SpiceDbProjectPermissions.VIEW,
 		subjectType: SpiceDbResourceTypes.USER,
 		subjectId: params.userId
 	});

package/dist/auth/authz/sync.d.ts

@@ -25,7 +25,7 @@ declare function changeOrgRole(params: {
 }): Promise<void>;
 /**
  * Sync a new project to SpiceDB.
- * Links project to org and grants creator project_admin role.
+ * Links project to org and grants creator project_admin role (if not already org admin/owner).
  * Call when: project is created.
  */
 declare function syncProjectToSpiceDb(params: {
@@ -81,5 +81,26 @@ declare function listProjectMembers(params: {
   userId: string;
   role: ProjectRole;
 }>>;
+/**
+ * List all project memberships for a specific user.
+ * Returns projects where the user has explicit project_admin, project_member, or project_viewer roles.
+ */
+declare function listUserProjectMembershipsInSpiceDb(params: {
+  tenantId: string;
+  userId: string;
+}): Promise<Array<{
+  projectId: string;
+  role: ProjectRole;
+}>>;
+/**
+ * Revoke all project memberships for a user.
+ * Call when: user is promoted to org admin (they get inherited access, explicit project roles become redundant).
+ *
+ * Uses efficient bulk delete - deletes all project relationships for user without listing first.
+ */
+declare function revokeAllProjectMemberships(params: {
+  tenantId: string;
+  userId: string;
+}): Promise<void>;
 //#endregion
-export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, removeProjectFromSpiceDb, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };
+export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };

package/dist/auth/authz/sync.js

@@ -1,5 +1,5 @@
-import { SpiceDbRelations, SpiceDbResourceTypes, isAuthzEnabled } from "./config.js";
-import { deleteRelationship, getSpiceClient, readRelationships, writeRelationship } from "./client.js";
+import { SpiceDbRelations, SpiceDbResourceTypes } from "./config.js";
+import { RelationshipOperation, deleteRelationship, getSpiceClient, readRelationships, writeRelationship } from "./client.js";
 
 //#region src/auth/authz/sync.ts
 /**
@@ -7,15 +7,11 @@ import { deleteRelationship, getSpiceClient, readRelationships, writeRelationshi
 *
 * Functions for syncing data between better-auth and SpiceDB.
 */
-const RELATIONSHIP_OPERATION_CREATE = 1;
-const RELATIONSHIP_OPERATION_TOUCH = 2;
-const RELATIONSHIP_OPERATION_DELETE = 3;
 /**
 * Sync a user's org membership to SpiceDB.
 * Call when: user joins org, role changes, user leaves org.
 */
 async function syncOrgMemberToSpiceDb(params) {
-	if (!isAuthzEnabled(params.tenantId)) return;
 	if (params.action === "add") await writeRelationship({
 		resourceType: SpiceDbResourceTypes.ORGANIZATION,
 		resourceId: params.tenantId,
@@ -37,11 +33,10 @@ async function syncOrgMemberToSpiceDb(params) {
 * Call when: user's org role is updated (e.g., member -> admin).
 */
 async function changeOrgRole(params) {
-	if (!isAuthzEnabled(params.tenantId)) return;
 	if (params.oldRole === params.newRole) return;
 	await getSpiceClient().promises.writeRelationships({
 		updates: [{
-			operation: RELATIONSHIP_OPERATION_DELETE,
+			operation: RelationshipOperation.DELETE,
 			relationship: {
 				resource: {
 					objectType: SpiceDbResourceTypes.ORGANIZATION,
@@ -58,7 +53,7 @@ async function changeOrgRole(params) {
 				optionalCaveat: void 0
 			}
 		}, {
-			operation: RELATIONSHIP_OPERATION_TOUCH,
+			operation: RelationshipOperation.TOUCH,
 			relationship: {
 				resource: {
 					objectType: SpiceDbResourceTypes.ORGANIZATION,
@@ -81,47 +76,55 @@ async function changeOrgRole(params) {
 }
 /**
 * Sync a new project to SpiceDB.
-* Links project to org and grants creator project_admin role.
+* Links project to org and grants creator project_admin role (if not already org admin/owner).
 * Call when: project is created.
 */
 async function syncProjectToSpiceDb(params) {
-	if (!isAuthzEnabled(params.tenantId)) return;
-	await getSpiceClient().promises.writeRelationships({
-		updates: [{
-			operation: RELATIONSHIP_OPERATION_CREATE,
-			relationship: {
-				resource: {
-					objectType: SpiceDbResourceTypes.PROJECT,
-					objectId: params.projectId
-				},
-				relation: SpiceDbRelations.ORGANIZATION,
-				subject: {
-					object: {
-						objectType: SpiceDbResourceTypes.ORGANIZATION,
-						objectId: params.tenantId
-					},
-					optionalRelation: ""
-				},
-				optionalCaveat: void 0
-			}
-		}, {
-			operation: RELATIONSHIP_OPERATION_CREATE,
-			relationship: {
-				resource: {
-					objectType: SpiceDbResourceTypes.PROJECT,
-					objectId: params.projectId
+	const spice = getSpiceClient();
+	const isOrgAdminOrOwner = (await readRelationships({
+		resourceType: SpiceDbResourceTypes.ORGANIZATION,
+		resourceId: params.tenantId,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.creatorUserId
+	})).some((r) => r.relation === SpiceDbRelations.ADMIN || r.relation === SpiceDbRelations.OWNER);
+	const updates = [{
+		operation: RelationshipOperation.CREATE,
+		relationship: {
+			resource: {
+				objectType: SpiceDbResourceTypes.PROJECT,
+				objectId: params.projectId
+			},
+			relation: SpiceDbRelations.ORGANIZATION,
+			subject: {
+				object: {
+					objectType: SpiceDbResourceTypes.ORGANIZATION,
+					objectId: params.tenantId
 				},
-				relation: SpiceDbRelations.PROJECT_ADMIN,
-				subject: {
-					object: {
-						objectType: SpiceDbResourceTypes.USER,
-						objectId: params.creatorUserId
-					},
-					optionalRelation: ""
+				optionalRelation: ""
+			},
+			optionalCaveat: void 0
+		}
+	}];
+	if (!isOrgAdminOrOwner) updates.push({
+		operation: RelationshipOperation.CREATE,
+		relationship: {
+			resource: {
+				objectType: SpiceDbResourceTypes.PROJECT,
+				objectId: params.projectId
+			},
+			relation: SpiceDbRelations.PROJECT_ADMIN,
+			subject: {
+				object: {
+					objectType: SpiceDbResourceTypes.USER,
+					objectId: params.creatorUserId
 				},
-				optionalCaveat: void 0
-			}
-		}],
+				optionalRelation: ""
+			},
+			optionalCaveat: void 0
+		}
+	});
+	await spice.promises.writeRelationships({
+		updates,
 		optionalPreconditions: [],
 		optionalTransactionMetadata: void 0
 	});
@@ -130,7 +133,6 @@ async function syncProjectToSpiceDb(params) {
 * Grant project access to a user.
 */
 async function grantProjectAccess(params) {
-	if (!isAuthzEnabled(params.tenantId)) throw new Error("Authorization is not enabled");
 	await writeRelationship({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
@@ -143,7 +145,6 @@ async function grantProjectAccess(params) {
 * Revoke project access from a user.
 */
 async function revokeProjectAccess(params) {
-	if (!isAuthzEnabled(params.tenantId)) throw new Error("Authorization is not enabled");
 	await deleteRelationship({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId,
@@ -157,11 +158,10 @@ async function revokeProjectAccess(params) {
 * Removes the old role and adds the new one atomically in a single transaction.
 */
 async function changeProjectRole(params) {
-	if (!isAuthzEnabled(params.tenantId)) throw new Error("Authorization is not enabled");
 	if (params.oldRole === params.newRole) return;
 	await getSpiceClient().promises.writeRelationships({
 		updates: [{
-			operation: RELATIONSHIP_OPERATION_DELETE,
+			operation: RelationshipOperation.DELETE,
 			relationship: {
 				resource: {
 					objectType: SpiceDbResourceTypes.PROJECT,
@@ -178,7 +178,7 @@ async function changeProjectRole(params) {
 				optionalCaveat: void 0
 			}
 		}, {
-			operation: RELATIONSHIP_OPERATION_TOUCH,
+			operation: RelationshipOperation.TOUCH,
 			relationship: {
 				resource: {
 					objectType: SpiceDbResourceTypes.PROJECT,
@@ -204,7 +204,6 @@ async function changeProjectRole(params) {
 * Call when: project is deleted.
 */
 async function removeProjectFromSpiceDb(params) {
-	if (!isAuthzEnabled(params.tenantId)) return;
 	await getSpiceClient().promises.deleteRelationships({
 		relationshipFilter: {
 			resourceType: SpiceDbResourceTypes.PROJECT,
@@ -223,7 +222,6 @@ async function removeProjectFromSpiceDb(params) {
 * Returns users with project_admin, project_member, or project_viewer roles.
 */
 async function listProjectMembers(params) {
-	if (!isAuthzEnabled(params.tenantId)) return [];
 	return (await readRelationships({
 		resourceType: SpiceDbResourceTypes.PROJECT,
 		resourceId: params.projectId
@@ -232,6 +230,82 @@ async function listProjectMembers(params) {
 		role: rel.relation
 	}));
 }
+/**
+* List all project memberships for a specific user.
+* Returns projects where the user has explicit project_admin, project_member, or project_viewer roles.
+*/
+async function listUserProjectMembershipsInSpiceDb(params) {
+	return (await readRelationships({
+		resourceType: SpiceDbResourceTypes.PROJECT,
+		subjectType: SpiceDbResourceTypes.USER,
+		subjectId: params.userId
+	})).filter((rel) => rel.relation === SpiceDbRelations.PROJECT_ADMIN || rel.relation === SpiceDbRelations.PROJECT_MEMBER || rel.relation === SpiceDbRelations.PROJECT_VIEWER).map((rel) => ({
+		projectId: rel.resourceId,
+		role: rel.relation
+	}));
+}
+/**
+* Revoke all project memberships for a user.
+* Call when: user is promoted to org admin (they get inherited access, explicit project roles become redundant).
+*
+* Uses efficient bulk delete - deletes all project relationships for user without listing first.
+*/
+async function revokeAllProjectMemberships(params) {
+	const spice = getSpiceClient();
+	await Promise.all([
+		spice.promises.deleteRelationships({
+			relationshipFilter: {
+				resourceType: SpiceDbResourceTypes.PROJECT,
+				optionalResourceId: "",
+				optionalResourceIdPrefix: "",
+				optionalRelation: SpiceDbRelations.PROJECT_ADMIN,
+				optionalSubjectFilter: {
+					subjectType: SpiceDbResourceTypes.USER,
+					optionalSubjectId: params.userId,
+					optionalRelation: void 0
+				}
+			},
+			optionalPreconditions: [],
+			optionalLimit: 0,
+			optionalAllowPartialDeletions: false,
+			optionalTransactionMetadata: void 0
+		}),
+		spice.promises.deleteRelationships({
+			relationshipFilter: {
+				resourceType: SpiceDbResourceTypes.PROJECT,
+				optionalResourceId: "",
+				optionalResourceIdPrefix: "",
+				optionalRelation: SpiceDbRelations.PROJECT_MEMBER,
+				optionalSubjectFilter: {
+					subjectType: SpiceDbResourceTypes.USER,
+					optionalSubjectId: params.userId,
+					optionalRelation: void 0
+				}
+			},
+			optionalPreconditions: [],
+			optionalLimit: 0,
+			optionalAllowPartialDeletions: false,
+			optionalTransactionMetadata: void 0
+		}),
+		spice.promises.deleteRelationships({
+			relationshipFilter: {
+				resourceType: SpiceDbResourceTypes.PROJECT,
+				optionalResourceId: "",
+				optionalResourceIdPrefix: "",
+				optionalRelation: SpiceDbRelations.PROJECT_VIEWER,
+				optionalSubjectFilter: {
+					subjectType: SpiceDbResourceTypes.USER,
+					optionalSubjectId: params.userId,
+					optionalRelation: void 0
+				}
+			},
+			optionalPreconditions: [],
+			optionalLimit: 0,
+			optionalAllowPartialDeletions: false,
+			optionalTransactionMetadata: void 0
+		})
+	]);
+}
 
 //#endregion
-export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, removeProjectFromSpiceDb, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };
+export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };

package/dist/auth/init.d.ts

@@ -0,0 +1 @@
+export { };

package/dist/auth/init.js

@@ -0,0 +1,115 @@
+import { OrgRoles } from "./authz/config.js";
+import { loadEnvironmentFiles } from "../env.js";
+import { syncOrgMemberToSpiceDb } from "./authz/sync.js";
+import "./authz/index.js";
+import { createAgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
+import { addUserToOrganization, upsertOrganization } from "../data-access/runtime/organizations.js";
+import { getUserByEmail } from "../data-access/runtime/users.js";
+import { createAuth } from "./auth.js";
+
+//#region src/auth/init.ts
+/**
+* Standalone initialization script for creating the default organization and admin user.
+* This script is designed to run during setup/migration, NOT at server startup.
+*
+* Uses upsertOrganization to create org with TENANT_ID as the actual organization ID,
+* and Better Auth's API for user creation.
+*
+* Usage: pnpm db:auth:init
+*
+* Required environment variables:
+* - INKEEP_AGENTS_RUN_DATABASE_URL: PostgreSQL connection string
+* - TENANT_ID: Organization/tenant ID (defaults to 'default') - this becomes the org ID
+* - INKEEP_AGENTS_MANAGE_UI_USERNAME: Admin email address
+* - INKEEP_AGENTS_MANAGE_UI_PASSWORD: Admin password (min 8 chars)
+* - BETTER_AUTH_SECRET: Secret for Better Auth
+*
+* Optional environment variables:
+* - INKEEP_AGENTS_API_URL: API URL for Better Auth (defaults to http://localhost:3002)
+*/
+loadEnvironmentFiles();
+const TENANT_ID = process.env.TENANT_ID || "default";
+async function init() {
+	console.log("🚀 Initializing database with default organization and user...\n");
+	const dbClient = createAgentsRunDatabaseClient();
+	const username = process.env.INKEEP_AGENTS_MANAGE_UI_USERNAME;
+	const password = process.env.INKEEP_AGENTS_MANAGE_UI_PASSWORD;
+	const authSecret = process.env.BETTER_AUTH_SECRET;
+	if (!username || !password) {
+		console.error("❌ INKEEP_AGENTS_MANAGE_UI_USERNAME and INKEEP_AGENTS_MANAGE_UI_PASSWORD are required");
+		console.error("   These credentials are used to create the initial admin user.");
+		process.exit(1);
+	}
+	if (!authSecret) {
+		console.error("❌ BETTER_AUTH_SECRET is required");
+		console.error("   This secret is used to sign authentication tokens.");
+		process.exit(1);
+	}
+	const auth = createAuth({
+		baseURL: process.env.INKEEP_AGENTS_API_URL || "http://localhost:3002",
+		secret: authSecret,
+		dbClient
+	});
+	console.log(`📦 Checking/creating organization: ${TENANT_ID}`);
+	const { created: orgCreated } = await upsertOrganization(dbClient)({
+		organizationId: TENANT_ID,
+		name: TENANT_ID,
+		slug: TENANT_ID,
+		logo: null,
+		metadata: null
+	});
+	if (orgCreated) console.log(`   ✅ Organization created with ID: ${TENANT_ID}`);
+	else console.log(`   ℹ️  Organization already exists: ${TENANT_ID}`);
+	console.log(`\n👤 Creating admin user: ${username}`);
+	let user = await getUserByEmail(dbClient)(username);
+	if (user) console.log(`   ℹ️  User already exists: ${username}`);
+	else {
+		console.log("   Creating user with Better Auth...");
+		if (!(await auth.api.signUpEmail({ body: {
+			email: username,
+			password,
+			name: username.split("@")[0]
+		} })).user) {
+			console.error("   ❌ Failed to create user: signUpEmail returned no user");
+			process.exit(1);
+		}
+		user = await getUserByEmail(dbClient)(username);
+		if (!user) {
+			console.error("   ❌ User was created but could not be retrieved from database");
+			process.exit(1);
+		}
+		console.log(`   ✅ User created: ${user.email}`);
+	}
+	console.log(`\n🔗 Adding user to organization...`);
+	await addUserToOrganization(dbClient)({
+		userId: user.id,
+		organizationId: TENANT_ID,
+		role: OrgRoles.ADMIN
+	});
+	console.log(`   ✅ User ${user.email} added as ${OrgRoles.ADMIN}`);
+	try {
+		await syncOrgMemberToSpiceDb({
+			tenantId: TENANT_ID,
+			userId: user.id,
+			role: OrgRoles.ADMIN,
+			action: "add"
+		});
+		console.log("   ✅ Synced to SpiceDB");
+	} catch {
+		console.log("   ℹ️  SpiceDB sync failed");
+	}
+	console.log("\n================================================");
+	console.log("✅ Initialization complete!");
+	console.log("================================================");
+	console.log(`\nOrganization: ${TENANT_ID}`);
+	console.log(`Admin user:   ${username} (owner)`);
+	console.log("\nYou can now log in with these credentials.\n");
+	process.exit(0);
+}
+init().catch((error) => {
+	console.error("\n❌ Initialization failed:", error);
+	process.exit(1);
+});
+
+//#endregion
+export {  };

package/dist/auth/permissions.d.ts

@@ -5,25 +5,25 @@ import { organizationClient } from "better-auth/client/plugins";
 //#region src/auth/permissions.d.ts
 declare const ac: AccessControl;
 declare const memberRole: {
-  authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key] | {
-    actions: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
   } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-  statements: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>;
+  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
 };
 declare const adminRole: {
-  authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key] | {
-    actions: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
   } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-  statements: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>;
+  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
 };
 declare const ownerRole: {
-  authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key] | {
-    actions: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
   } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-  statements: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>;
+  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
 };
 //#endregion
 export { ac, adminRole, memberRole, organizationClient, ownerRole };

package/dist/client-exports.d.ts

@@ -1,3 +1,4 @@
+import { OrgRole, OrgRoles, ProjectRole, ProjectRoles } from "./auth/authz/config.js";
 import { BreakdownComponentDef, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextBreakdown, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, parseContextBreakdownFromSpan } from "./constants/context-breakdown.js";
 import { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AI_OPERATIONS, AI_TOOL_TYPES, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, SPAN_KEYS, SPAN_NAMES, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, UNKNOWN_VALUE } from "./constants/otel-attributes.js";
 import { AGGREGATE_OPERATORS, DATA_SOURCES, DATA_TYPES, FIELD_TYPES, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS } from "./constants/signoz-queries.js";
@@ -7,7 +8,7 @@ import { DEFAULT_NANGO_STORE_ID } from "./credential-stores/default-constants.js
 import { detectAuthenticationRequired } from "./utils/auth-detection.js";
 import { validatePropsAsJsonSchema } from "./validation/props-validation.js";
 import "./index.js";
-import { AgentStopWhen, AgentStopWhenSchema, ApiKeyApiUpdateSchema, FullAgentAgentInsertSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, ModelSettings, ModelSettingsSchema, StopWhen, StopWhenSchema, SubAgentStopWhen, SubAgentStopWhenSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse } from "./validation/schemas.js";
+import { AgentStopWhen, AgentStopWhenSchema, ApiKeyApiUpdateSchema, FullAgentAgentInsertSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, ModelSettings, ModelSettingsSchema, ResourceIdSchema, SignatureSource, SignatureVerificationConfig, SignatureVerificationConfigSchema, SignedComponent, StopWhen, StopWhenSchema, SubAgentStopWhen, SubAgentStopWhenSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema } from "./validation/schemas.js";
 import { z } from "@hono/zod-openapi";
 
 //#region src/client-exports.d.ts
@@ -306,12 +307,8 @@ type InternalAgentDefinition = z.infer<typeof FullAgentAgentInsertSchema>;
 type ExternalAgentDefinition = z.infer<typeof ExternalAgentApiInsertSchema>;
 type TenantParams = z.infer<typeof TenantParamsSchema>;
 type ErrorResponse = z.infer<typeof ErrorResponseSchema>;
-declare const MIN_ID_LENGTH = 1;
-declare const MAX_ID_LENGTH = 255;
-declare const URL_SAFE_ID_PATTERN: RegExp;
-declare const resourceIdSchema: z.ZodString;
 declare function generateIdFromName(name: string): string;
 type ToolInsert = ToolApiInsert;
 type AgentAgentInsert = AgentAgentApiInsert;
 //#endregion
-export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsert, AgentAgentApiInsertSchema, AgentAgentInsert, AgentApiInsert, AgentApiInsertSchema, type AgentStopWhen, AgentStopWhenSchema, ApiKeyApiCreationResponse, ApiKeyApiCreationResponseSchema, ApiKeyApiSelect, ApiKeyApiSelectSchema, ApiKeyApiUpdateResponse, ArtifactComponentApiInsert, ArtifactComponentApiInsertSchema, BreakdownComponentDef, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextBreakdown, ContextConfigApiInsert, ContextConfigApiInsertSchema, CredentialReferenceApiInsert, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsert, DataComponentApiInsertSchema, ErrorResponse, ErrorResponseSchema, ExternalAgentApiInsert, ExternalAgentApiInsertSchema, ExternalAgentDefinition, FIELD_TYPES, FullAgentDefinition, FullAgentDefinitionSchema, FunctionApiInsert, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, InternalAgentDefinition, ListResponseSchema, MAX_ID_LENGTH, MCPTransportType, MIN_ID_LENGTH, type ModelSettings, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, PaginationSchema, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, SPAN_KEYS, SPAN_NAMES, SingleResponseSchema, type StopWhen, StopWhenSchema, type SubAgentStopWhen, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParams, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsert, ToolApiInsertSchema, ToolInsert, TriggerApiInsert, TriggerApiInsertSchema, TriggerApiSelect, TriggerApiSelectSchema, TriggerApiUpdate, TriggerApiUpdateSchema, TriggerInvocationApiSelect, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, UNKNOWN_VALUE, URL_SAFE_ID_PATTERN, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, resourceIdSchema, validatePropsAsJsonSchema };
+export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsert, AgentAgentApiInsertSchema, AgentAgentInsert, AgentApiInsert, AgentApiInsertSchema, type AgentStopWhen, AgentStopWhenSchema, ApiKeyApiCreationResponse, ApiKeyApiCreationResponseSchema, ApiKeyApiSelect, ApiKeyApiSelectSchema, ApiKeyApiUpdateResponse, ArtifactComponentApiInsert, ArtifactComponentApiInsertSchema, BreakdownComponentDef, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextBreakdown, ContextConfigApiInsert, ContextConfigApiInsertSchema, CredentialReferenceApiInsert, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsert, DataComponentApiInsertSchema, ErrorResponse, ErrorResponseSchema, ExternalAgentApiInsert, ExternalAgentApiInsertSchema, ExternalAgentDefinition, FIELD_TYPES, FullAgentDefinition, FullAgentDefinitionSchema, FunctionApiInsert, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, InternalAgentDefinition, ListResponseSchema, MCPTransportType, type ModelSettings, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, type OrgRole, OrgRoles, PANEL_TYPES, PaginationSchema, type ProjectRole, ProjectRoles, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, ResourceIdSchema, SPAN_KEYS, SPAN_NAMES, type SignatureSource, type SignatureVerificationConfig, SignatureVerificationConfigSchema, type SignedComponent, SingleResponseSchema, type StopWhen, StopWhenSchema, type SubAgentStopWhen, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParams, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsert, ToolApiInsertSchema, ToolInsert, TriggerApiInsert, TriggerApiInsertSchema, TriggerApiSelect, TriggerApiSelectSchema, TriggerApiUpdate, TriggerApiUpdateSchema, TriggerInvocationApiSelect, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, validatePropsAsJsonSchema };

package/dist/client-exports.js

@@ -1,8 +1,9 @@
 import { schemaValidationDefaults } from "./constants/schema-validation/defaults.js";
 import { CredentialStoreType, MCPTransportType } from "./types/utility.js";
-import { AgentStopWhenSchema, ArtifactComponentApiInsertSchema as ArtifactComponentApiInsertSchema$1, FullAgentAgentInsertSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, ModelSettingsSchema, StopWhenSchema, SubAgentStopWhenSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse } from "./validation/schemas.js";
-import { DEFAULT_NANGO_STORE_ID } from "./credential-stores/default-constants.js";
 import { validatePropsAsJsonSchema } from "./validation/props-validation.js";
+import { AgentStopWhenSchema, ArtifactComponentApiInsertSchema as ArtifactComponentApiInsertSchema$1, FullAgentAgentInsertSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, MAX_ID_LENGTH, ModelSettingsSchema, ResourceIdSchema, SignatureVerificationConfigSchema, StopWhenSchema, SubAgentStopWhenSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema } from "./validation/schemas.js";
+import { DEFAULT_NANGO_STORE_ID } from "./credential-stores/default-constants.js";
+import { OrgRoles, ProjectRoles } from "./auth/authz/config.js";
 import { CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, parseContextBreakdownFromSpan } from "./constants/context-breakdown.js";
 import { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AI_OPERATIONS, AI_TOOL_TYPES, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, SPAN_KEYS, SPAN_NAMES, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, UNKNOWN_VALUE } from "./constants/otel-attributes.js";
 import { AGGREGATE_OPERATORS, DATA_SOURCES, DATA_TYPES, FIELD_TYPES, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS } from "./constants/signoz-queries.js";
@@ -159,13 +160,9 @@ const FullAgentDefinitionSchema = AgentAgentApiInsertSchema.extend({
 		})).optional()
 	}).optional()
 });
-const MIN_ID_LENGTH = 1;
-const MAX_ID_LENGTH = 255;
-const URL_SAFE_ID_PATTERN = /^[a-zA-Z0-9\-_.]+$/;
-const resourceIdSchema = z.string().min(MIN_ID_LENGTH).max(MAX_ID_LENGTH).regex(URL_SAFE_ID_PATTERN, { message: "ID must contain only letters, numbers, hyphens, underscores, and dots" });
 function generateIdFromName(name) {
 	return name.toLowerCase().replace(/[^a-zA-Z0-9]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, MAX_ID_LENGTH);
 }
 
 //#endregion
-export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsertSchema, AgentApiInsertSchema, AgentStopWhenSchema, ApiKeyApiCreationResponseSchema, ApiKeyApiSelectSchema, ArtifactComponentApiInsertSchema, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextConfigApiInsertSchema, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsertSchema, ErrorResponseSchema, ExternalAgentApiInsertSchema, FIELD_TYPES, FullAgentDefinitionSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, ListResponseSchema, MAX_ID_LENGTH, MCPTransportType, MIN_ID_LENGTH, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, PaginationSchema, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, SPAN_KEYS, SPAN_NAMES, SingleResponseSchema, StopWhenSchema, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsertSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, UNKNOWN_VALUE, URL_SAFE_ID_PATTERN, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, resourceIdSchema, validatePropsAsJsonSchema };
+export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsertSchema, AgentApiInsertSchema, AgentStopWhenSchema, ApiKeyApiCreationResponseSchema, ApiKeyApiSelectSchema, ArtifactComponentApiInsertSchema, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextConfigApiInsertSchema, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsertSchema, ErrorResponseSchema, ExternalAgentApiInsertSchema, FIELD_TYPES, FullAgentDefinitionSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, ListResponseSchema, MCPTransportType, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, OrgRoles, PANEL_TYPES, PaginationSchema, ProjectRoles, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, ResourceIdSchema, SPAN_KEYS, SPAN_NAMES, SignatureVerificationConfigSchema, SingleResponseSchema, StopWhenSchema, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsertSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, validatePropsAsJsonSchema };

package/dist/constants/execution-limits-shared/defaults.d.ts

@@ -4,7 +4,7 @@
  * These define limits and defaults for runtime execution, not schema validation.
  */
 declare const executionLimitsSharedDefaults: {
-  readonly MCP_TOOL_CONNECTION_TIMEOUT_MS: 3000;
+  readonly MCP_TOOL_CONNECTION_TIMEOUT_MS: 10000;
   readonly MCP_TOOL_MAX_RETRIES: 3;
   readonly MCP_TOOL_MAX_RECONNECTION_DELAY_MS: 30000;
   readonly MCP_TOOL_INITIAL_RECONNECTION_DELAY_MS: 1000;

package/dist/constants/execution-limits-shared/defaults.js

@@ -4,7 +4,7 @@
 * These define limits and defaults for runtime execution, not schema validation.
 */
 const executionLimitsSharedDefaults = {
-	MCP_TOOL_CONNECTION_TIMEOUT_MS: 3e3,
+	MCP_TOOL_CONNECTION_TIMEOUT_MS: 1e4,
 	MCP_TOOL_MAX_RETRIES: 3,
 	MCP_TOOL_MAX_RECONNECTION_DELAY_MS: 3e4,
 	MCP_TOOL_INITIAL_RECONNECTION_DELAY_MS: 1e3,

package/dist/constants/execution-limits-shared/index.d.ts

@@ -1,6 +1,6 @@
 import { executionLimitsSharedDefaults } from "./defaults.js";
 
 //#region src/constants/execution-limits-shared/index.d.ts
-declare const MCP_TOOL_CONNECTION_TIMEOUT_MS: 3000, MCP_TOOL_MAX_RETRIES: 3, MCP_TOOL_MAX_RECONNECTION_DELAY_MS: 30000, MCP_TOOL_INITIAL_RECONNECTION_DELAY_MS: 1000, MCP_TOOL_RECONNECTION_DELAY_GROWTH_FACTOR: 1.5, CONVERSATION_HISTORY_DEFAULT_LIMIT: 50, CONVERSATION_HISTORY_MAX_OUTPUT_TOKENS_DEFAULT: 8000;
+declare const MCP_TOOL_CONNECTION_TIMEOUT_MS: 10000, MCP_TOOL_MAX_RETRIES: 3, MCP_TOOL_MAX_RECONNECTION_DELAY_MS: 30000, MCP_TOOL_INITIAL_RECONNECTION_DELAY_MS: 1000, MCP_TOOL_RECONNECTION_DELAY_GROWTH_FACTOR: 1.5, CONVERSATION_HISTORY_DEFAULT_LIMIT: 50, CONVERSATION_HISTORY_MAX_OUTPUT_TOKENS_DEFAULT: 8000;
 //#endregion
 export { CONVERSATION_HISTORY_DEFAULT_LIMIT, CONVERSATION_HISTORY_MAX_OUTPUT_TOKENS_DEFAULT, MCP_TOOL_CONNECTION_TIMEOUT_MS, MCP_TOOL_INITIAL_RECONNECTION_DELAY_MS, MCP_TOOL_MAX_RECONNECTION_DELAY_MS, MCP_TOOL_MAX_RETRIES, MCP_TOOL_RECONNECTION_DELAY_GROWTH_FACTOR, executionLimitsSharedDefaults };