@inkeep/agents-core 0.45.1 → 0.45.3

package/dist/auth/auth-validation-schemas.d.ts

@@ -1,9 +1,9 @@
 import { z } from "@hono/zod-openapi";
 import * as drizzle_orm_pg_core1242 from "drizzle-orm/pg-core";
-import * as drizzle_zod319 from "drizzle-zod";
+import * as drizzle_zod315 from "drizzle-zod";
 
 //#region src/auth/auth-validation-schemas.d.ts
-declare const UserSelectSchema: drizzle_zod319.BuildSchema<"select", {
+declare const UserSelectSchema: drizzle_zod315.BuildSchema<"select", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "user";
@@ -124,7 +124,7 @@ declare const UserSelectSchema: drizzle_zod319.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const UserInsertSchema: drizzle_zod319.BuildSchema<"insert", {
+declare const UserInsertSchema: drizzle_zod315.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "user";
@@ -245,7 +245,7 @@ declare const UserInsertSchema: drizzle_zod319.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const SessionSelectSchema: drizzle_zod319.BuildSchema<"select", {
+declare const SessionSelectSchema: drizzle_zod315.BuildSchema<"select", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "session";
@@ -400,7 +400,7 @@ declare const SessionSelectSchema: drizzle_zod319.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const SessionInsertSchema: drizzle_zod319.BuildSchema<"insert", {
+declare const SessionInsertSchema: drizzle_zod315.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "session";
@@ -555,7 +555,7 @@ declare const SessionInsertSchema: drizzle_zod319.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const AccountSelectSchema: drizzle_zod319.BuildSchema<"select", {
+declare const AccountSelectSchema: drizzle_zod315.BuildSchema<"select", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "account";
@@ -778,7 +778,7 @@ declare const AccountSelectSchema: drizzle_zod319.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const AccountInsertSchema: drizzle_zod319.BuildSchema<"insert", {
+declare const AccountInsertSchema: drizzle_zod315.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "account";
@@ -1001,7 +1001,7 @@ declare const AccountInsertSchema: drizzle_zod319.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const OrganizationSelectSchema: drizzle_zod319.BuildSchema<"select", {
+declare const OrganizationSelectSchema: drizzle_zod315.BuildSchema<"select", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "organization";
@@ -1105,7 +1105,7 @@ declare const OrganizationSelectSchema: drizzle_zod319.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const OrganizationInsertSchema: drizzle_zod319.BuildSchema<"insert", {
+declare const OrganizationInsertSchema: drizzle_zod315.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "organization";
@@ -1209,7 +1209,7 @@ declare const OrganizationInsertSchema: drizzle_zod319.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const MemberSelectSchema: drizzle_zod319.BuildSchema<"select", {
+declare const MemberSelectSchema: drizzle_zod315.BuildSchema<"select", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "member";
@@ -1296,7 +1296,7 @@ declare const MemberSelectSchema: drizzle_zod319.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const MemberInsertSchema: drizzle_zod319.BuildSchema<"insert", {
+declare const MemberInsertSchema: drizzle_zod315.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "member";
@@ -1383,7 +1383,7 @@ declare const MemberInsertSchema: drizzle_zod319.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const InvitationSelectSchema: drizzle_zod319.BuildSchema<"select", {
+declare const InvitationSelectSchema: drizzle_zod315.BuildSchema<"select", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "invitation";
@@ -1521,7 +1521,7 @@ declare const InvitationSelectSchema: drizzle_zod319.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const InvitationInsertSchema: drizzle_zod319.BuildSchema<"insert", {
+declare const InvitationInsertSchema: drizzle_zod315.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "invitation";
@@ -1659,7 +1659,7 @@ declare const InvitationInsertSchema: drizzle_zod319.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const DeviceCodeSelectSchema: drizzle_zod319.BuildSchema<"select", {
+declare const DeviceCodeSelectSchema: drizzle_zod315.BuildSchema<"select", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "device_code";
@@ -1831,7 +1831,7 @@ declare const DeviceCodeSelectSchema: drizzle_zod319.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const DeviceCodeInsertSchema: drizzle_zod319.BuildSchema<"insert", {
+declare const DeviceCodeInsertSchema: drizzle_zod315.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "device_code";
@@ -2003,7 +2003,7 @@ declare const DeviceCodeInsertSchema: drizzle_zod319.BuildSchema<"insert", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const VerificationSelectSchema: drizzle_zod319.BuildSchema<"select", {
+declare const VerificationSelectSchema: drizzle_zod315.BuildSchema<"select", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "verification";
@@ -2107,7 +2107,7 @@ declare const VerificationSelectSchema: drizzle_zod319.BuildSchema<"select", {
     generated: undefined;
   }, {}, {}>;
 }, undefined, undefined>;
-declare const VerificationInsertSchema: drizzle_zod319.BuildSchema<"insert", {
+declare const VerificationInsertSchema: drizzle_zod315.BuildSchema<"insert", {
   id: drizzle_orm_pg_core1242.PgColumn<{
     name: "id";
     tableName: "verification";

package/dist/auth/auth.d.ts

@@ -2,7 +2,7 @@ import { AgentsRunDatabaseClient } from "../db/runtime/runtime-client.js";
 import * as _better_auth_sso0 from "@better-auth/sso";
 import * as better_auth0 from "better-auth";
 import { BetterAuthAdvancedOptions } from "better-auth";
-import * as better_auth_plugins20 from "better-auth/plugins";
+import * as better_auth_plugins0 from "better-auth/plugins";
 import * as zod0 from "zod";
 import { GoogleOptions } from "better-auth/social-providers";
 
@@ -57,6 +57,7 @@ interface BetterAuthConfig {
   baseURL: string;
   secret: string;
   dbClient: AgentsRunDatabaseClient;
+  cookieDomain?: string;
   ssoProviders?: SSOProviderConfig[];
   socialProviders?: {
     google?: GoogleOptions;
@@ -70,6 +71,23 @@ interface UserAuthConfig {
   };
   advanced?: BetterAuthAdvancedOptions;
 }
+/**
+ * Extracts the root domain from a URL for cross-subdomain cookie sharing.
+ *
+ * When the API and UI share a common 3-part parent (e.g., api.pilot.inkeep.com
+ * and pilot.inkeep.com both share .pilot.inkeep.com), the function auto-computes
+ * the shared parent. When domains don't share a 3-part parent (e.g.,
+ * api.agents.inkeep.com and app.inkeep.com), set AUTH_COOKIE_DOMAIN explicitly.
+ *
+ * Examples (auto-computed from baseURL):
+ * - https://api.pilot.inkeep.com -> .pilot.inkeep.com
+ * - https://pilot.inkeep.com -> .pilot.inkeep.com
+ * - http://localhost:3002 -> undefined (no domain for localhost)
+ *
+ * With AUTH_COOKIE_DOMAIN=.inkeep.com:
+ * - Any *.inkeep.com URL -> .inkeep.com
+ */
+declare function extractCookieDomain(baseURL: string, explicitDomain?: string): string | undefined;
 declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
   baseURL: string;
   secret: string;
@@ -219,7 +237,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
       }[];
     };
-    options: better_auth_plugins20.BearerOptions | undefined;
+    options: better_auth_plugins0.BearerOptions | undefined;
   }, {
     id: "sso";
     endpoints: {
@@ -847,30 +865,30 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     };
   }, {
     id: "organization";
-    endpoints: better_auth_plugins20.OrganizationEndpoints<{
+    endpoints: better_auth_plugins0.OrganizationEndpoints<{
       allowUserToCreateOrganization: true;
-      ac: better_auth_plugins20.AccessControl;
+      ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "invitation" | "member" | "organization" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "invitation" | "member" | "organization" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "invitation" | "member" | "organization" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
       };
       creatorRole: "admin";
@@ -881,9 +899,9 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         role: string;
         email: string;
-        organization: better_auth_plugins20.Organization;
-        invitation: better_auth_plugins20.Invitation;
-        inviter: better_auth_plugins20.Member & {
+        organization: better_auth_plugins0.Organization;
+        invitation: better_auth_plugins0.Invitation;
+        inviter: better_auth_plugins0.Member & {
           user: better_auth0.User;
         };
       }): Promise<void>;
@@ -893,28 +911,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           user,
           organization: org
         }: {
-          invitation: better_auth_plugins20.Invitation & Record<string, any>;
-          member: better_auth_plugins20.Member & Record<string, any>;
+          invitation: better_auth_plugins0.Invitation & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
         beforeUpdateMemberRole: ({
           member,
           organization: org,
           newRole
         }: {
-          member: better_auth_plugins20.Member & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           newRole: string;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
         afterRemoveMember: ({
           member,
           organization: org
         }: {
-          member: better_auth_plugins20.Member & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
       };
     }>;
@@ -1046,7 +1064,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         organizationId: string;
         email: string;
         role: "member" | "owner" | "admin";
-        status: better_auth_plugins20.InvitationStatus;
+        status: better_auth_plugins0.InvitationStatus;
         inviterId: string;
         expiresAt: Date;
         createdAt: Date;
@@ -1085,7 +1103,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           organizationId: string;
           email: string;
           role: "member" | "owner" | "admin";
-          status: better_auth_plugins20.InvitationStatus;
+          status: better_auth_plugins0.InvitationStatus;
           inviterId: string;
           expiresAt: Date;
           createdAt: Date;
@@ -1159,28 +1177,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
     };
     options: NoInfer<{
       allowUserToCreateOrganization: true;
-      ac: better_auth_plugins20.AccessControl;
+      ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "invitation" | "member" | "organization" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "invitation" | "member" | "organization" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "invitation" | "member" | "organization" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key] | {
-            actions: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
-          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-          statements: better_auth_plugins20.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins20.Statements>;
+          } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
         };
       };
       creatorRole: "admin";
@@ -1191,9 +1209,9 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         id: string;
         role: string;
         email: string;
-        organization: better_auth_plugins20.Organization;
-        invitation: better_auth_plugins20.Invitation;
-        inviter: better_auth_plugins20.Member & {
+        organization: better_auth_plugins0.Organization;
+        invitation: better_auth_plugins0.Invitation;
+        inviter: better_auth_plugins0.Member & {
           user: better_auth0.User;
         };
       }): Promise<void>;
@@ -1203,28 +1221,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
           user,
           organization: org
         }: {
-          invitation: better_auth_plugins20.Invitation & Record<string, any>;
-          member: better_auth_plugins20.Member & Record<string, any>;
+          invitation: better_auth_plugins0.Invitation & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
         beforeUpdateMemberRole: ({
           member,
           organization: org,
           newRole
         }: {
-          member: better_auth_plugins20.Member & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           newRole: string;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
         afterRemoveMember: ({
           member,
           organization: org
         }: {
-          member: better_auth_plugins20.Member & Record<string, any>;
+          member: better_auth_plugins0.Member & Record<string, any>;
           user: better_auth0.User & Record<string, any>;
-          organization: better_auth_plugins20.Organization & Record<string, any>;
+          organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
       };
     }>;
@@ -1561,8 +1579,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       readonly AUTHENTICATION_REQUIRED: "Authentication required";
     };
     options: Partial<{
-      expiresIn: better_auth_plugins20.TimeString;
-      interval: better_auth_plugins20.TimeString;
+      expiresIn: better_auth_plugins0.TimeString;
+      interval: better_auth_plugins0.TimeString;
       deviceCodeLength: number;
       userCodeLength: number;
       schema: {
@@ -1591,4 +1609,4 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
 }>;
 declare const auth: ReturnType<typeof createAuth>;
 //#endregion
-export { BetterAuthConfig, OIDCProviderConfig, SAMLProviderConfig, SSOProviderConfig, UserAuthConfig, auth, createAuth };
+export { BetterAuthConfig, OIDCProviderConfig, SAMLProviderConfig, SSOProviderConfig, UserAuthConfig, auth, createAuth, extractCookieDomain };

package/dist/auth/auth.js

@@ -22,16 +22,22 @@ async function getInitialOrganization(dbClient, userId) {
 }
 /**
 * Extracts the root domain from a URL for cross-subdomain cookie sharing.
-* For example:
+*
+* When the API and UI share a common 3-part parent (e.g., api.pilot.inkeep.com
+* and pilot.inkeep.com both share .pilot.inkeep.com), the function auto-computes
+* the shared parent. When domains don't share a 3-part parent (e.g.,
+* api.agents.inkeep.com and app.inkeep.com), set AUTH_COOKIE_DOMAIN explicitly.
+*
+* Examples (auto-computed from baseURL):
 * - https://api.pilot.inkeep.com -> .pilot.inkeep.com
 * - https://pilot.inkeep.com -> .pilot.inkeep.com
 * - http://localhost:3002 -> undefined (no domain for localhost)
 *
-* The logic extracts the parent domain that can be shared across subdomains.
-* For domains with 3+ parts, it takes everything except the first part.
-* For domains with exactly 2 parts, it takes both parts.
+* With AUTH_COOKIE_DOMAIN=.inkeep.com:
+* - Any *.inkeep.com URL -> .inkeep.com
 */
-function extractCookieDomain(baseURL) {
+function extractCookieDomain(baseURL, explicitDomain) {
+	if (explicitDomain) return explicitDomain.startsWith(".") ? explicitDomain : `.${explicitDomain}`;
 	try {
 		const hostname = new URL(baseURL).hostname;
 		if (hostname === "localhost" || hostname.match(/^\d+\.\d+\.\d+\.\d+$/)) return;
@@ -65,7 +71,7 @@ async function registerSSOProvider(dbClient, provider) {
 	}
 }
 function createAuth(config) {
-	const cookieDomain = extractCookieDomain(config.baseURL);
+	const cookieDomain = extractCookieDomain(config.baseURL, config.cookieDomain);
 	const auth$1 = betterAuth({
 		baseURL: config.baseURL,
 		secret: config.secret,
@@ -114,7 +120,6 @@ function createAuth(config) {
 				sameSite: "none",
 				secure: true,
 				httpOnly: true,
-				partitioned: true,
 				...cookieDomain && { domain: cookieDomain }
 			},
 			...config.advanced
@@ -219,4 +224,4 @@ function createAuth(config) {
 const auth = null;
 
 //#endregion
-export { auth, createAuth };
+export { auth, createAuth, extractCookieDomain };

package/dist/auth/permissions.d.ts

@@ -1,29 +1,29 @@
-import * as better_auth_plugins0 from "better-auth/plugins";
+import * as better_auth_plugins69 from "better-auth/plugins";
 import { AccessControl } from "better-auth/plugins/access";
 import { organizationClient } from "better-auth/client/plugins";
 
 //#region src/auth/permissions.d.ts
 declare const ac: AccessControl;
 declare const memberRole: {
-  authorize<K_1 extends "invitation" | "member" | "organization" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
-    actions: better_auth_plugins0.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-  statements: better_auth_plugins0.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
+  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>;
 };
 declare const adminRole: {
-  authorize<K_1 extends "invitation" | "member" | "organization" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
-    actions: better_auth_plugins0.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-  statements: better_auth_plugins0.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
+  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>;
 };
 declare const ownerRole: {
-  authorize<K_1 extends "invitation" | "member" | "organization" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
-    actions: better_auth_plugins0.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key] | {
+    actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-  statements: better_auth_plugins0.Subset<"invitation" | "member" | "organization" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
+  statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins69.Statements>;
 };
 //#endregion
 export { ac, adminRole, memberRole, organizationClient, ownerRole };

package/dist/client-exports.d.ts

@@ -10,9 +10,9 @@ import { validatePropsAsJsonSchema } from "./validation/props-validation.js";
 import "./index.js";
 import { AgentStopWhen, AgentStopWhenSchema, ApiKeyApiUpdateSchema, FullAgentAgentInsertSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, ModelSettings, ModelSettingsSchema, ResourceIdSchema, SignatureSource, SignatureVerificationConfig, SignatureVerificationConfigSchema, SignedComponent, StopWhen, StopWhenSchema, SubAgentStopWhen, SubAgentStopWhenSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema } from "./validation/schemas.js";
 import { z } from "@hono/zod-openapi";
+import { convertJsonSchemaToZod } from "zod-from-json-schema";
 
 //#region src/client-exports.d.ts
-
 declare const TenantParamsSchema: z.ZodObject<{
   tenantId: z.ZodString;
 }, z.core.$strip>;
@@ -311,4 +311,4 @@ declare function generateIdFromName(name: string): string;
 type ToolInsert = ToolApiInsert;
 type AgentAgentInsert = AgentAgentApiInsert;
 //#endregion
-export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsert, AgentAgentApiInsertSchema, AgentAgentInsert, AgentApiInsert, AgentApiInsertSchema, type AgentStopWhen, AgentStopWhenSchema, ApiKeyApiCreationResponse, ApiKeyApiCreationResponseSchema, ApiKeyApiSelect, ApiKeyApiSelectSchema, ApiKeyApiUpdateResponse, ArtifactComponentApiInsert, ArtifactComponentApiInsertSchema, BreakdownComponentDef, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextBreakdown, ContextConfigApiInsert, ContextConfigApiInsertSchema, CredentialReferenceApiInsert, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsert, DataComponentApiInsertSchema, ErrorResponse, ErrorResponseSchema, ExternalAgentApiInsert, ExternalAgentApiInsertSchema, ExternalAgentDefinition, FIELD_TYPES, FullAgentDefinition, FullAgentDefinitionSchema, FunctionApiInsert, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, InternalAgentDefinition, ListResponseSchema, MCPTransportType, type ModelSettings, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, type OrgRole, OrgRoles, PANEL_TYPES, PaginationSchema, type ProjectRole, ProjectRoles, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, ResourceIdSchema, SPAN_KEYS, SPAN_NAMES, type SignatureSource, type SignatureVerificationConfig, SignatureVerificationConfigSchema, type SignedComponent, SingleResponseSchema, type StopWhen, StopWhenSchema, type SubAgentStopWhen, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParams, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsert, ToolApiInsertSchema, ToolInsert, TriggerApiInsert, TriggerApiInsertSchema, TriggerApiSelect, TriggerApiSelectSchema, TriggerApiUpdate, TriggerApiUpdateSchema, TriggerInvocationApiSelect, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, validatePropsAsJsonSchema };
+export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsert, AgentAgentApiInsertSchema, AgentAgentInsert, AgentApiInsert, AgentApiInsertSchema, type AgentStopWhen, AgentStopWhenSchema, ApiKeyApiCreationResponse, ApiKeyApiCreationResponseSchema, ApiKeyApiSelect, ApiKeyApiSelectSchema, ApiKeyApiUpdateResponse, ArtifactComponentApiInsert, ArtifactComponentApiInsertSchema, BreakdownComponentDef, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextBreakdown, ContextConfigApiInsert, ContextConfigApiInsertSchema, CredentialReferenceApiInsert, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsert, DataComponentApiInsertSchema, ErrorResponse, ErrorResponseSchema, ExternalAgentApiInsert, ExternalAgentApiInsertSchema, ExternalAgentDefinition, FIELD_TYPES, FullAgentDefinition, FullAgentDefinitionSchema, FunctionApiInsert, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, InternalAgentDefinition, ListResponseSchema, MCPTransportType, type ModelSettings, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, type OrgRole, OrgRoles, PANEL_TYPES, PaginationSchema, type ProjectRole, ProjectRoles, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, ResourceIdSchema, SPAN_KEYS, SPAN_NAMES, type SignatureSource, type SignatureVerificationConfig, SignatureVerificationConfigSchema, type SignedComponent, SingleResponseSchema, type StopWhen, StopWhenSchema, type SubAgentStopWhen, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParams, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsert, ToolApiInsertSchema, ToolInsert, TriggerApiInsert, TriggerApiInsertSchema, TriggerApiSelect, TriggerApiSelectSchema, TriggerApiUpdate, TriggerApiUpdateSchema, TriggerInvocationApiSelect, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, convertJsonSchemaToZod, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, validatePropsAsJsonSchema };

package/dist/client-exports.js

@@ -9,6 +9,7 @@ import { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AI_OPERATIO
 import { AGGREGATE_OPERATORS, DATA_SOURCES, DATA_TYPES, FIELD_TYPES, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS } from "./constants/signoz-queries.js";
 import { detectAuthenticationRequired } from "./utils/auth-detection.js";
 import { z } from "@hono/zod-openapi";
+import { convertJsonSchemaToZod } from "zod-from-json-schema";
 
 //#region src/client-exports.ts
 /**
@@ -165,4 +166,4 @@ function generateIdFromName(name) {
 }
 
 //#endregion
-export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsertSchema, AgentApiInsertSchema, AgentStopWhenSchema, ApiKeyApiCreationResponseSchema, ApiKeyApiSelectSchema, ArtifactComponentApiInsertSchema, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextConfigApiInsertSchema, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsertSchema, ErrorResponseSchema, ExternalAgentApiInsertSchema, FIELD_TYPES, FullAgentDefinitionSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, ListResponseSchema, MCPTransportType, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, OrgRoles, PANEL_TYPES, PaginationSchema, ProjectRoles, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, ResourceIdSchema, SPAN_KEYS, SPAN_NAMES, SignatureVerificationConfigSchema, SingleResponseSchema, StopWhenSchema, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsertSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, validatePropsAsJsonSchema };
+export { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AGGREGATE_OPERATORS, AI_OPERATIONS, AI_TOOL_TYPES, AgentAgentApiInsertSchema, AgentApiInsertSchema, AgentStopWhenSchema, ApiKeyApiCreationResponseSchema, ApiKeyApiSelectSchema, ArtifactComponentApiInsertSchema, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextConfigApiInsertSchema, CredentialReferenceApiInsertSchema, CredentialStoreType, DATA_SOURCES, DATA_TYPES, DEFAULT_NANGO_STORE_ID, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, DataComponentApiInsertSchema, ErrorResponseSchema, ExternalAgentApiInsertSchema, FIELD_TYPES, FullAgentDefinitionSchema, FunctionApiInsertSchema, FunctionApiSelectSchema, FunctionApiUpdateSchema, IdParamsSchema, ListResponseSchema, MCPTransportType, ModelSettingsSchema, OPERATORS, ORDER_DIRECTIONS, OrgRoles, PANEL_TYPES, PaginationSchema, ProjectRoles, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS, ResourceIdSchema, SPAN_KEYS, SPAN_NAMES, SignatureVerificationConfigSchema, SingleResponseSchema, StopWhenSchema, SubAgentStopWhenSchema, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, TenantParamsSchema, TenantProjectIdParamsSchema, TenantProjectParamsSchema, ToolApiInsertSchema, TriggerApiInsertSchema, TriggerApiSelectSchema, TriggerApiUpdateSchema, TriggerInvocationApiSelectSchema, TriggerInvocationListResponse, TriggerInvocationResponse, TriggerInvocationStatusEnum, TriggerListResponse, TriggerResponse, TriggerWithWebhookUrlListResponse, TriggerWithWebhookUrlResponse, TriggerWithWebhookUrlSchema, UNKNOWN_VALUE, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, convertJsonSchemaToZod, createEmptyBreakdown, detectAuthenticationRequired, generateIdFromName, parseContextBreakdownFromSpan, validatePropsAsJsonSchema };