@inkeep/agents-manage-api 0.39.5 → 0.41.0

package/dist/factory.js

@@ -1,4 +1,37 @@
-import { a as createManagementHono, i as initializeDefaultUser, n as createAuth0Provider, r as createOIDCProvider, t as createManagementApp } from "./factory2.js";
-import "./chunk-VBDAOXYI.js";
+import { env } from "./env.js";
+import dbClient_default from "./data/db/dbClient.js";
+import { createManagementHono } from "./create-app.js";
+import { initializeDefaultUser } from "./initialization.js";
+import { createAuth0Provider, createOIDCProvider } from "./sso-helpers.js";
+import { CredentialStoreRegistry, createDefaultCredentialStores } from "@inkeep/agents-core";
+import { createAuth } from "@inkeep/agents-core/auth";
 
+//#region src/factory.ts
+const defaultConfig = {
+	port: 3002,
+	serverOptions: {
+		requestTimeout: 6e4,
+		keepAliveTimeout: 6e4,
+		keepAlive: true
+	}
+};
+function createManagementAuth(userAuthConfig) {
+	if (env.DISABLE_AUTH) return null;
+	return createAuth({
+		baseURL: env.INKEEP_AGENTS_MANAGE_API_URL || "http://localhost:3002",
+		secret: env.BETTER_AUTH_SECRET || "development-secret-change-in-production",
+		dbClient: dbClient_default,
+		...userAuthConfig?.ssoProviders && { ssoProviders: userAuthConfig.ssoProviders },
+		...userAuthConfig?.socialProviders && { socialProviders: userAuthConfig.socialProviders }
+	});
+}
+function createManagementApp(config) {
+	const serverConfig = config?.serverConfig ?? defaultConfig;
+	const registry = new CredentialStoreRegistry(config?.credentialStores ?? createDefaultCredentialStores());
+	const auth$1 = createManagementAuth(config?.auth);
+	if (!config?.skipInitialization && env.ENVIRONMENT !== "test") initializeDefaultUser(auth$1);
+	return createManagementHono(serverConfig, registry, auth$1);
+}
+
+//#endregion
 export { createAuth0Provider, createManagementApp, createManagementHono, createOIDCProvider, initializeDefaultUser };

package/dist/index.d.ts

@@ -1,10 +1,12 @@
-import { a as createOIDCProvider, i as createAuth0Provider, n as UserAuthConfig, o as initializeDefaultUser, r as createManagementApp, s as createManagementHono, t as SSOProviderConfig } from "./factory2.js";
+import { createManagementHono } from "./create-app.js";
+import { initializeDefaultUser } from "./initialization.js";
+import { createAuth0Provider, createOIDCProvider } from "./sso-helpers.js";
+import { SSOProviderConfig, UserAuthConfig, createManagementApp } from "./factory.js";
 import { Hono } from "hono";
 import * as better_auth0 from "better-auth";
-import * as better_auth_social_providers0 from "better-auth/social-providers";
+import * as better_auth_plugins0 from "better-auth/plugins";
 import * as zod0 from "zod";
 import * as _better_auth_sso0 from "@better-auth/sso";
-import * as better_auth_plugins0 from "better-auth/plugins";
 
 //#region src/index.d.ts
 declare const auth: better_auth0.Auth<{
@@ -19,7 +21,51 @@ declare const auth: better_auth0.Auth<{
     autoSignIn: true;
   };
   socialProviders: {
-    google: better_auth_social_providers0.GoogleOptions;
+    google: {
+      redirectURI?: string | undefined;
+      clientId: string;
+      accessType?: ("offline" | "online") | undefined;
+      display?: ("page" | "popup" | "touch" | "wap") | undefined;
+      hd?: string | undefined;
+      clientSecret?: string | undefined;
+      scope?: string[] | undefined;
+      disableDefaultScope?: boolean | undefined;
+      clientKey?: string | undefined;
+      disableIdTokenSignIn?: boolean | undefined;
+      verifyIdToken?: ((token: string, nonce?: string) => Promise<boolean>) | undefined;
+      getUserInfo?: ((token: better_auth0.OAuth2Tokens) => Promise<{
+        user: {
+          id: string;
+          name?: string;
+          email?: string | null;
+          image?: string;
+          emailVerified: boolean;
+          [key: string]: any;
+        };
+        data: any;
+      } | null>) | undefined;
+      refreshAccessToken?: ((refreshToken: string) => Promise<better_auth0.OAuth2Tokens>) | undefined;
+      mapProfileToUser?: ((profile: better_auth0.GoogleProfile) => {
+        id?: string;
+        name?: string;
+        email?: string | null;
+        image?: string;
+        emailVerified?: boolean;
+        [key: string]: any;
+      } | Promise<{
+        id?: string;
+        name?: string;
+        email?: string | null;
+        image?: string;
+        emailVerified?: boolean;
+        [key: string]: any;
+      }>) | undefined;
+      disableImplicitSignUp?: boolean | undefined;
+      disableSignUp?: boolean | undefined;
+      prompt?: ("select_account" | "consent" | "login" | "none" | "select_account consent") | undefined;
+      responseMode?: ("query" | "form_post") | undefined;
+      overrideUserInfoOnSignIn?: boolean | undefined;
+    };
   } | undefined;
   session: {
     expiresIn: number;
@@ -57,6 +103,9 @@ declare const auth: better_auth0.Auth<{
       generateId?: better_auth0.GenerateIdFn | false | "serial" | "uuid";
     } | undefined;
     trustedProxyHeaders?: boolean | undefined;
+    backgroundTasks?: {
+      handler: (promise: Promise<void>) => void;
+    };
   };
   trustedOrigins: string[];
   plugins: [{
@@ -75,6 +124,7 @@ declare const auth: better_auth0.Auth<{
         handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
       }[];
     };
+    options: better_auth_plugins0.BearerOptions | undefined;
   }, {
     id: "sso";
     endpoints: {
@@ -99,8 +149,6 @@ declare const auth: better_auth0.Auth<{
             };
           };
         };
-      } & {
-        use: any[];
       }, Response>>;
       registerSSOProvider: better_auth0.StrictEndpoint<"/sso/register", {
         method: "POST";
@@ -120,6 +168,7 @@ declare const auth: better_auth0.Auth<{
             }>>;
             jwksEndpoint: zod0.ZodOptional<zod0.ZodString>;
             discoveryEndpoint: zod0.ZodOptional<zod0.ZodString>;
+            skipDiscovery: zod0.ZodOptional<zod0.ZodBoolean>;
             scopes: zod0.ZodOptional<zod0.ZodArray<zod0.ZodString>>;
             pkce: zod0.ZodOptional<zod0.ZodDefault<zod0.ZodBoolean>>;
             mapping: zod0.ZodOptional<zod0.ZodObject<{
@@ -364,9 +413,11 @@ declare const auth: better_auth0.Auth<{
             };
           };
         };
-      } & {
-        use: any[];
       }, {
+        redirectURI: string;
+        oidcConfig: _better_auth_sso0.OIDCConfig | null;
+        samlConfig: _better_auth_sso0.SAMLConfig | null;
+      } & Omit<{
         issuer: string;
         oidcConfig?: _better_auth_sso0.OIDCConfig | undefined;
         samlConfig?: _better_auth_sso0.SAMLConfig | undefined;
@@ -374,7 +425,7 @@ declare const auth: better_auth0.Auth<{
         providerId: string;
         organizationId?: string | undefined;
         domain: string;
-      }>;
+      }, "oidcConfig" | "samlConfig">>;
       signInSSO: ReturnType<(options?: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sign-in/sso", {
         method: "POST";
         body: zod0.ZodObject<{
@@ -389,8 +440,8 @@ declare const auth: better_auth0.Auth<{
           loginHint: zod0.ZodOptional<zod0.ZodString>;
           requestSignUp: zod0.ZodOptional<zod0.ZodBoolean>;
           providerType: zod0.ZodOptional<zod0.ZodEnum<{
-            oidc: "oidc";
             saml: "saml";
+            oidc: "oidc";
           }>>;
         }, better_auth0.$strip>;
         metadata: {
@@ -465,8 +516,6 @@ declare const auth: better_auth0.Auth<{
             };
           };
         };
-      } & {
-        use: any[];
       }, {
         url: string;
         redirect: boolean;
@@ -481,7 +530,6 @@ declare const auth: better_auth0.Auth<{
         }, better_auth0.$strip>;
         allowedMediaTypes: string[];
         metadata: {
-          isAction: false;
           openapi: {
             operationId: string;
             summary: string;
@@ -492,9 +540,8 @@ declare const auth: better_auth0.Auth<{
               };
             };
           };
+          scope: "server";
         };
-      } & {
-        use: any[];
       }, never>>;
       callbackSSOSAML: ReturnType<(options?: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/saml2/callback/:providerId", {
         method: "POST";
@@ -503,7 +550,6 @@ declare const auth: better_auth0.Auth<{
           RelayState: zod0.ZodOptional<zod0.ZodString>;
         }, better_auth0.$strip>;
         metadata: {
-          isAction: false;
           allowedMediaTypes: string[];
           openapi: {
             operationId: string;
@@ -521,9 +567,8 @@ declare const auth: better_auth0.Auth<{
               };
             };
           };
+          scope: "server";
         };
-      } & {
-        use: any[];
       }, never>>;
       acsEndpoint: ReturnType<(options?: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/saml2/sp/acs/:providerId", {
         method: "POST";
@@ -535,7 +580,6 @@ declare const auth: better_auth0.Auth<{
           RelayState: zod0.ZodOptional<zod0.ZodString>;
         }, better_auth0.$strip>;
         metadata: {
-          isAction: false;
           allowedMediaTypes: string[];
           openapi: {
             operationId: string;
@@ -547,9 +591,8 @@ declare const auth: better_auth0.Auth<{
               };
             };
           };
+          scope: "server";
         };
-      } & {
-        use: any[];
       }, never>>;
     } & {
       requestDomainVerification: ReturnType<(options: _better_auth_sso0.SSOOptions) => better_auth0.StrictEndpoint<"/sso/request-domain-verification", {
@@ -597,8 +640,6 @@ declare const auth: better_auth0.Auth<{
             };
           };
         }>)[];
-      } & {
-        use: any[];
       }, {
         domainVerificationToken: string;
       }>>;
@@ -650,8 +691,6 @@ declare const auth: better_auth0.Auth<{
             };
           };
         }>)[];
-      } & {
-        use: any[];
       }, void>>;
     };
     schema: any;
@@ -660,6 +699,57 @@ declare const auth: better_auth0.Auth<{
         enabled: true;
       };
     };
+  }, {
+    id: "oauth-proxy";
+    options: NoInfer<{
+      productionURL: string;
+    }>;
+    endpoints: {
+      oAuthProxy: better_auth0.StrictEndpoint<"/oauth-proxy-callback", {
+        method: "GET";
+        operationId: string;
+        query: zod0.ZodObject<{
+          callbackURL: zod0.ZodString;
+          cookies: zod0.ZodString;
+        }, better_auth0.$strip>;
+        use: ((inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>)[];
+        metadata: {
+          openapi: {
+            operationId: string;
+            description: string;
+            parameters: {
+              in: "query";
+              name: string;
+              required: true;
+              description: string;
+            }[];
+            responses: {
+              302: {
+                description: string;
+                headers: {
+                  Location: {
+                    description: string;
+                    schema: {
+                      type: string;
+                    };
+                  };
+                };
+              };
+            };
+          };
+        };
+      }, never>;
+    };
+    hooks: {
+      before: {
+        matcher(context: better_auth0.HookEndpointContext): boolean;
+        handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
+      }[];
+      after: {
+        matcher(context: better_auth0.HookEndpointContext): boolean;
+        handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
+      }[];
+    };
   }, {
     id: "organization";
     endpoints: better_auth_plugins0.OrganizationEndpoints<{
@@ -667,25 +757,25 @@ declare const auth: better_auth0.Auth<{
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -941,30 +1031,30 @@ declare const auth: better_auth0.Auth<{
       readonly ROLE_NAME_IS_ALREADY_TAKEN: "That role name is already taken";
       readonly CANNOT_DELETE_A_PRE_DEFINED_ROLE: "Cannot delete a pre-defined role";
     };
-    options: {
+    options: NoInfer<{
       allowUserToCreateOrganization: true;
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"function" | "organization" | "ac" | "member" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "invitation" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"function" | "organization" | "member" | "invitation" | "ac" | "project" | "agent" | "sub_agent" | "tool" | "api_key" | "credential" | "data_component" | "artifact_component" | "external_agent" | "context_config" | "team", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -980,7 +1070,7 @@ declare const auth: better_auth0.Auth<{
           user: better_auth0.User;
         };
       }): Promise<void>;
-    };
+    }>;
   }, {
     id: "device-authorization";
     schema: {
@@ -1103,8 +1193,6 @@ declare const auth: better_auth0.Auth<{
             };
           };
         };
-      } & {
-        use: any[];
       }, {
         device_code: string;
         user_code: string;
@@ -1175,8 +1263,6 @@ declare const auth: better_auth0.Auth<{
             };
           };
         };
-      } & {
-        use: any[];
       }, {
         access_token: string;
         token_type: string;
@@ -1222,8 +1308,6 @@ declare const auth: better_auth0.Auth<{
             };
           };
         };
-      } & {
-        use: any[];
       }, {
         user_code: string;
         status: string;
@@ -1264,8 +1348,6 @@ declare const auth: better_auth0.Auth<{
             };
           };
         };
-      } & {
-        use: any[];
       }, {
         success: boolean;
       }>;
@@ -1303,8 +1385,6 @@ declare const auth: better_auth0.Auth<{
             };
           };
         };
-      } & {
-        use: any[];
       }, {
         success: boolean;
       }>;
@@ -1323,9 +1403,35 @@ declare const auth: better_auth0.Auth<{
       readonly INVALID_DEVICE_CODE_STATUS: "Invalid device code status";
       readonly AUTHENTICATION_REQUIRED: "Authentication required";
     };
+    options: Partial<{
+      expiresIn: better_auth_plugins0.TimeString;
+      interval: better_auth_plugins0.TimeString;
+      deviceCodeLength: number;
+      userCodeLength: number;
+      schema: {
+        deviceCode?: {
+          modelName?: string | undefined;
+          fields?: {
+            deviceCode?: string | undefined;
+            userCode?: string | undefined;
+            userId?: string | undefined;
+            expiresAt?: string | undefined;
+            status?: string | undefined;
+            lastPolledAt?: string | undefined;
+            pollingInterval?: string | undefined;
+            clientId?: string | undefined;
+            scope?: string | undefined;
+          } | undefined;
+        } | undefined;
+      };
+      generateDeviceCode?: (() => string | Promise<string>) | undefined;
+      generateUserCode?: (() => string | Promise<string>) | undefined;
+      validateClient?: ((clientId: string) => boolean | Promise<boolean>) | undefined;
+      onDeviceAuthRequest?: ((clientId: string, scope: string | undefined) => void | Promise<void>) | undefined;
+      verificationUri?: string | undefined;
+    }>;
   }];
 }> | null;
 declare const app: Hono;
 //#endregion
-export { Hono, type SSOProviderConfig, type UserAuthConfig, auth, createAuth0Provider, createManagementApp, createManagementHono, createOIDCProvider, app as default, initializeDefaultUser };
-//# sourceMappingURL=index.d.ts.map
+export { Hono, type SSOProviderConfig, type UserAuthConfig, auth, createAuth0Provider, createManagementApp, createManagementHono, createOIDCProvider, app as default, initializeDefaultUser };

package/dist/index.js

@@ -1,8 +1,12 @@
-import { a as createManagementHono, i as initializeDefaultUser, n as createAuth0Provider, o as dbClient_default, r as createOIDCProvider, s as env, t as createManagementApp } from "./factory2.js";
-import "./chunk-VBDAOXYI.js";
+import { env } from "./env.js";
+import dbClient_default from "./data/db/dbClient.js";
+import { createManagementHono } from "./create-app.js";
+import { initializeDefaultUser } from "./initialization.js";
+import { createAuth0Provider, createOIDCProvider } from "./sso-helpers.js";
+import { createManagementApp } from "./factory.js";
+import { Hono } from "hono";
 import { CredentialStoreRegistry, createDefaultCredentialStores } from "@inkeep/agents-core";
 import { createAuth } from "@inkeep/agents-core/auth";
-import { Hono } from "hono";
 
 //#region src/index.ts
 const defaultConfig = {
@@ -44,5 +48,4 @@ if (env.ENVIRONMENT === "development") initializeDefaultUser(auth);
 var src_default = app;
 
 //#endregion
-export { Hono, auth, createAuth0Provider, createManagementApp, createManagementHono, createOIDCProvider, src_default as default, initializeDefaultUser };
-//# sourceMappingURL=index.js.map
+export { Hono, auth, createAuth0Provider, createManagementApp, createManagementHono, createOIDCProvider, src_default as default, initializeDefaultUser };

package/dist/initialization.d.ts

@@ -0,0 +1,6 @@
+import { createAuth } from "@inkeep/agents-core/auth";
+
+//#region src/initialization.d.ts
+declare function initializeDefaultUser(authInstance?: ReturnType<typeof createAuth> | null): Promise<void>;
+//#endregion
+export { initializeDefaultUser };

package/dist/initialization.js

@@ -0,0 +1,79 @@
+import { env } from "./env.js";
+import { getLogger as getLogger$1 } from "./logger.js";
+import dbClient_default from "./data/db/dbClient.js";
+import { generateId, getUserByEmail, member, organization } from "@inkeep/agents-core";
+import { and, eq } from "drizzle-orm";
+
+//#region src/initialization.ts
+const logger = getLogger$1("initialization");
+async function initializeDefaultUser(authInstance) {
+	const { INKEEP_AGENTS_MANAGE_UI_USERNAME, INKEEP_AGENTS_MANAGE_UI_PASSWORD, DISABLE_AUTH } = env;
+	const hasCredentials = INKEEP_AGENTS_MANAGE_UI_USERNAME && INKEEP_AGENTS_MANAGE_UI_PASSWORD;
+	const orgId = env.TENANT_ID;
+	if ((await dbClient_default.select().from(organization).where(eq(organization.id, orgId)).limit(1)).length === 0) {
+		await dbClient_default.insert(organization).values({
+			id: orgId,
+			name: env.TENANT_ID,
+			slug: env.TENANT_ID,
+			createdAt: /* @__PURE__ */ new Date(),
+			logo: null,
+			metadata: null
+		});
+		logger.info({ organizationId: orgId }, "Created default organization");
+	} else logger.info({ organizationId: orgId }, "Organization already exists");
+	if (!hasCredentials || DISABLE_AUTH || !authInstance) {
+		logger.info({ hasCredentials: false }, "Skipping default user creation");
+		return;
+	}
+	try {
+		let user = await getUserByEmail(dbClient_default)(INKEEP_AGENTS_MANAGE_UI_USERNAME);
+		if (user) logger.info({
+			email: INKEEP_AGENTS_MANAGE_UI_USERNAME,
+			userId: user.id
+		}, "Default user already exists");
+		else {
+			logger.info({ email: INKEEP_AGENTS_MANAGE_UI_USERNAME }, "Creating default user with Better Auth...");
+			if (!(await authInstance.api.signUpEmail({ body: {
+				email: INKEEP_AGENTS_MANAGE_UI_USERNAME,
+				password: INKEEP_AGENTS_MANAGE_UI_PASSWORD,
+				name: INKEEP_AGENTS_MANAGE_UI_USERNAME.split("@")[0]
+			} })).user) throw new Error("signUpEmail returned no user");
+			user = await getUserByEmail(dbClient_default)(INKEEP_AGENTS_MANAGE_UI_USERNAME);
+			if (!user) throw new Error("User was created but could not be retrieved from database");
+			logger.info({
+				email: user.email,
+				id: user.id
+			}, "Default user created from INKEEP_AGENTS_MANAGE_UI_USERNAME/INKEEP_AGENTS_MANAGE_UI_PASSWORD");
+		}
+		if ((await dbClient_default.select().from(member).where(and(eq(member.userId, user.id), eq(member.organizationId, orgId))).limit(1)).length === 0) {
+			await dbClient_default.insert(member).values({
+				id: generateId(),
+				userId: user.id,
+				organizationId: orgId,
+				role: "owner",
+				createdAt: /* @__PURE__ */ new Date()
+			});
+			logger.info({
+				userId: user.id,
+				organizationId: orgId
+			}, "Added user as organization owner");
+		} else logger.info({
+			userId: user.id,
+			organizationId: orgId
+		}, "User already a member of organization");
+		logger.info({
+			organizationId: orgId,
+			organizationSlug: env.TENANT_ID,
+			userId: user.id,
+			email: INKEEP_AGENTS_MANAGE_UI_USERNAME
+		}, "✅ Initialization complete - login with these credentials");
+	} catch (error) {
+		logger.error({
+			error,
+			email: INKEEP_AGENTS_MANAGE_UI_USERNAME
+		}, "❌ Failed to create default user");
+	}
+}
+
+//#endregion
+export { initializeDefaultUser };

package/dist/logger.d.ts

@@ -0,0 +1,2 @@
+import { getLogger } from "@inkeep/agents-core";
+export { getLogger };

package/dist/logger.js

@@ -0,0 +1,3 @@
+import { getLogger } from "@inkeep/agents-core";
+
+export { getLogger };

package/dist/middleware/auth.d.ts

@@ -0,0 +1,24 @@
+import * as hono0 from "hono";
+import { ExecutionContext } from "@inkeep/agents-core";
+import { createAuth } from "@inkeep/agents-core/auth";
+
+//#region src/middleware/auth.d.ts
+
+/**
+ * Middleware to authenticate API requests using Bearer token authentication
+ * Authentication priority:
+ * 1. Bypass secret (INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET)
+ * 2. Better-auth session token (from device authorization flow)
+ * 3. Database API key
+ */
+declare const apiKeyAuth: () => hono0.MiddlewareHandler<{
+  Variables: {
+    executionContext: ExecutionContext;
+    userId?: string;
+    userEmail?: string;
+    tenantId?: string;
+    auth: ReturnType<typeof createAuth> | null;
+  };
+}, string, {}, Response>;
+//#endregion
+export { apiKeyAuth };