@inkeep/agents-api 0.0.0-dev-20260123202200 → 0.0.0-dev-20260123205017

package/dist/.well-known/workflow/v1/manifest.debug.json

@@ -1,5 +1,16 @@
 {
   "steps": {
+    "node_modules/.pnpm/workflow@4.0.1-beta.33_@aws-sdk+client-sts@3.970.0_@opentelemetry+api@1.9.0_@types+reac_d0e39273ec53983ee1a59c0952eb17f2/node_modules/workflow/dist/internal/builtins.js": {
+      "__builtin_response_array_buffer": {
+        "stepId": "__builtin_response_array_buffer"
+      },
+      "__builtin_response_json": {
+        "stepId": "__builtin_response_json"
+      },
+      "__builtin_response_text": {
+        "stepId": "__builtin_response_text"
+      }
+    },
     "src/domains/evals/workflow/functions/runDatasetItem.ts": {
       "callChatApiStep": {
         "stepId": "step//src/domains/evals/workflow/functions/runDatasetItem.ts//callChatApiStep"
@@ -14,17 +25,6 @@
         "stepId": "step//src/domains/evals/workflow/functions/runDatasetItem.ts//logStep"
       }
     },
-    "node_modules/.pnpm/workflow@4.0.1-beta.33_@aws-sdk+client-sts@3.970.0_@opentelemetry+api@1.9.0_@types+reac_d0e39273ec53983ee1a59c0952eb17f2/node_modules/workflow/dist/internal/builtins.js": {
-      "__builtin_response_array_buffer": {
-        "stepId": "__builtin_response_array_buffer"
-      },
-      "__builtin_response_json": {
-        "stepId": "__builtin_response_json"
-      },
-      "__builtin_response_text": {
-        "stepId": "__builtin_response_text"
-      }
-    },
     "src/domains/evals/workflow/functions/evaluateConversation.ts": {
       "executeEvaluatorStep": {
         "stepId": "step//src/domains/evals/workflow/functions/evaluateConversation.ts//executeEvaluatorStep"

package/dist/.well-known/workflow/v1/step.cjs

@@ -109784,6 +109784,7 @@ var subAgentFunctionToolRelations = pgTable("sub_agent_function_tool_relations",
   functionToolId: varchar("function_tool_id", {
     length: 256
   }).notNull(),
+  toolPolicies: jsonb("tool_policies").$type(),
   ...timestamps
 }, (table) => [
   primaryKey({
@@ -210538,7 +210539,8 @@ var getFullAgentDefinitionInternal = /* @__PURE__ */ __name((db) => async ({ sco
       tenantId: functionTools.tenantId,
       projectId: functionTools.projectId,
       agentId: functionTools.agentId,
-      agentToolRelationId: subAgentFunctionToolRelations.id
+      agentToolRelationId: subAgentFunctionToolRelations.id,
+      toolPolicies: subAgentFunctionToolRelations.toolPolicies
     }).from(subAgentFunctionToolRelations).innerJoin(functionTools, and(eq(subAgentFunctionToolRelations.functionToolId, functionTools.id), eq(subAgentFunctionToolRelations.tenantId, functionTools.tenantId), eq(subAgentFunctionToolRelations.projectId, functionTools.projectId), eq(subAgentFunctionToolRelations.agentId, functionTools.agentId))).where(and(eq(subAgentFunctionToolRelations.tenantId, tenantId), eq(subAgentFunctionToolRelations.projectId, projectId), eq(subAgentFunctionToolRelations.agentId, agentId), eq(subAgentFunctionToolRelations.subAgentId, agent$1.id)));
     const agentDataComponentIds = (await db.query.subAgentDataComponents.findMany({
       where: and(eq(subAgentDataComponents.tenantId, tenantId), eq(subAgentDataComponents.subAgentId, agent$1.id))
@@ -210558,7 +210560,7 @@ var getFullAgentDefinitionInternal = /* @__PURE__ */ __name((db) => async ({ sco
       toolId: tool2.id,
       toolSelection: null,
       headers: null,
-      toolPolicies: null
+      toolPolicies: tool2.toolPolicies || null
     }));
     const canUse = [
       ...mcpToolCanUse,

package/dist/data/db/runDbClient.d.ts

@@ -1,6 +1,6 @@
-import * as _inkeep_agents_core2 from "@inkeep/agents-core";
+import * as _inkeep_agents_core0 from "@inkeep/agents-core";
 
 //#region src/data/db/runDbClient.d.ts
-declare const runDbClient: _inkeep_agents_core2.AgentsRunDatabaseClient;
+declare const runDbClient: _inkeep_agents_core0.AgentsRunDatabaseClient;
 //#endregion
 export { runDbClient as default };

package/dist/domains/evals/routes/datasetTriggers.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono18 from "hono";
+import * as hono14 from "hono";
 
 //#region src/domains/evals/routes/datasetTriggers.d.ts
-declare const app: OpenAPIHono<hono18.Env, {}, "/">;
+declare const app: OpenAPIHono<hono14.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/evals/routes/index.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono16 from "hono";
+import * as hono15 from "hono";
 
 //#region src/domains/evals/routes/index.d.ts
-declare const app: OpenAPIHono<hono16.Env, {}, "/">;
+declare const app: OpenAPIHono<hono15.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/evals/workflow/routes.d.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
-import * as hono_types8 from "hono/types";
+import * as hono_types5 from "hono/types";
 
 //#region src/domains/evals/workflow/routes.d.ts
-declare const workflowRoutes: Hono<hono_types8.BlankEnv, hono_types8.BlankSchema, "/">;
+declare const workflowRoutes: Hono<hono_types5.BlankEnv, hono_types5.BlankSchema, "/">;
 //#endregion
 export { workflowRoutes };

package/dist/domains/manage/routes/conversations.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono17 from "hono";
+import * as hono16 from "hono";
 
 //#region src/domains/manage/routes/conversations.d.ts
-declare const app: OpenAPIHono<hono17.Env, {}, "/">;
+declare const app: OpenAPIHono<hono16.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/evals/evaluationResults.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono14 from "hono";
+import * as hono17 from "hono";
 
 //#region src/domains/manage/routes/evals/evaluationResults.d.ts
-declare const app: OpenAPIHono<hono14.Env, {}, "/">;
+declare const app: OpenAPIHono<hono17.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/index.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono15 from "hono";
+import * as hono18 from "hono";
 
 //#region src/domains/manage/routes/index.d.ts
-declare const app: OpenAPIHono<hono15.Env, {}, "/">;
+declare const app: OpenAPIHono<hono18.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/mcp.d.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
-import * as hono_types5 from "hono/types";
+import * as hono_types7 from "hono/types";
 
 //#region src/domains/manage/routes/mcp.d.ts
-declare const app: Hono<hono_types5.BlankEnv, hono_types5.BlankSchema, "/">;
+declare const app: Hono<hono_types7.BlankEnv, hono_types7.BlankSchema, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/signoz.d.ts

@@ -1,10 +1,10 @@
 import { ManageAppVariables } from "../../../types/app.js";
 import { Hono } from "hono";
-import * as hono_types7 from "hono/types";
+import * as hono_types9 from "hono/types";
 
 //#region src/domains/manage/routes/signoz.d.ts
 declare const app: Hono<{
   Variables: ManageAppVariables;
-}, hono_types7.BlankSchema, "/">;
+}, hono_types9.BlankSchema, "/">;
 //#endregion
 export { app as default };

package/dist/domains/run/agents/Agent.js

@@ -819,10 +819,12 @@ var Agent = class {
 					continue;
 				}
 				const zodSchema = jsonSchemaToZod(functionData.inputSchema);
+				const toolPolicies = functionToolDef.toolPolicies;
+				const needsApproval = !!toolPolicies?.["*"]?.needsApproval || !!toolPolicies?.[functionToolDef.name]?.needsApproval;
 				const aiTool = tool({
 					description: functionToolDef.description || functionToolDef.name,
 					inputSchema: zodSchema,
-					execute: async (args, { toolCallId }) => {
+					execute: async (args, { toolCallId, providerMetadata }) => {
 						let processedArgs;
 						try {
 							processedArgs = parseEmbeddedJson(args);
@@ -839,6 +841,95 @@ var Agent = class {
 							processedArgs = args;
 						}
 						const finalArgs = processedArgs;
+						if (needsApproval) {
+							logger.info({
+								toolName: functionToolDef.name,
+								toolCallId,
+								args: finalArgs
+							}, "Function tool requires approval - waiting for user response");
+							const currentSpan = trace.getActiveSpan();
+							if (currentSpan) currentSpan.addEvent("tool.approval.requested", {
+								"tool.name": functionToolDef.name,
+								"tool.callId": toolCallId,
+								"subAgent.id": this.config.id
+							});
+							tracer.startActiveSpan("tool.approval_requested", { attributes: {
+								"tool.name": functionToolDef.name,
+								"tool.callId": toolCallId,
+								"subAgent.id": this.config.id,
+								"subAgent.name": this.config.name
+							} }, (requestSpan) => {
+								requestSpan.setStatus({ code: SpanStatusCode.OK });
+								requestSpan.end();
+							});
+							const streamHelper = this.getStreamingHelper();
+							if (streamHelper) await streamHelper.writeToolApprovalRequest({
+								approvalId: `aitxt-${toolCallId}`,
+								toolCallId
+							});
+							else if (this.isDelegatedAgent) {
+								const streamRequestId$1 = this.getStreamRequestId();
+								if (streamRequestId$1) await toolApprovalUiBus.publish(streamRequestId$1, {
+									type: "approval-needed",
+									toolCallId,
+									toolName: functionToolDef.name,
+									input: finalArgs,
+									providerMetadata,
+									approvalId: `aitxt-${toolCallId}`
+								});
+							}
+							const approvalResult = await pendingToolApprovalManager.waitForApproval(toolCallId, functionToolDef.name, args, this.conversationId || "unknown", this.config.id);
+							if (!approvalResult.approved) {
+								if (!streamHelper && this.isDelegatedAgent) {
+									const streamRequestId$1 = this.getStreamRequestId();
+									if (streamRequestId$1) await toolApprovalUiBus.publish(streamRequestId$1, {
+										type: "approval-resolved",
+										toolCallId,
+										approved: false
+									});
+								}
+								return tracer.startActiveSpan("tool.approval_denied", { attributes: {
+									"tool.name": functionToolDef.name,
+									"tool.callId": toolCallId,
+									"subAgent.id": this.config.id,
+									"subAgent.name": this.config.name
+								} }, (denialSpan) => {
+									logger.info({
+										toolName: functionToolDef.name,
+										toolCallId,
+										reason: approvalResult.reason
+									}, "Function tool execution denied by user");
+									denialSpan.setStatus({ code: SpanStatusCode.OK });
+									denialSpan.end();
+									return {
+										__inkeepToolDenied: true,
+										toolCallId,
+										reason: approvalResult.reason
+									};
+								});
+							}
+							tracer.startActiveSpan("tool.approval_approved", { attributes: {
+								"tool.name": functionToolDef.name,
+								"tool.callId": toolCallId,
+								"subAgent.id": this.config.id,
+								"subAgent.name": this.config.name
+							} }, (approvedSpan) => {
+								logger.info({
+									toolName: functionToolDef.name,
+									toolCallId
+								}, "Function tool approved, continuing with execution");
+								approvedSpan.setStatus({ code: SpanStatusCode.OK });
+								approvedSpan.end();
+							});
+							if (!streamHelper && this.isDelegatedAgent) {
+								const streamRequestId$1 = this.getStreamRequestId();
+								if (streamRequestId$1) await toolApprovalUiBus.publish(streamRequestId$1, {
+									type: "approval-resolved",
+									toolCallId,
+									approved: true
+								});
+							}
+						}
 						logger.debug({
 							toolName: functionToolDef.name,
 							toolCallId,
@@ -876,7 +967,7 @@ var Agent = class {
 						}
 					}
 				});
-				functionTools[functionToolDef.name] = this.wrapToolWithStreaming(functionToolDef.name, aiTool, streamRequestId || "", "tool");
+				functionTools[functionToolDef.name] = this.wrapToolWithStreaming(functionToolDef.name, aiTool, streamRequestId || "", "tool", { needsApproval });
 			}
 		} catch (error) {
 			logger.error({ error }, "Failed to load function tools from database");

package/dist/domains/run/agents/relationTools.d.ts

@@ -1,6 +1,6 @@
 import { AgentConfig, DelegateRelation } from "./Agent.js";
 import { InternalRelation } from "../utils/project.js";
-import * as _inkeep_agents_core0 from "@inkeep/agents-core";
+import * as _inkeep_agents_core1 from "@inkeep/agents-core";
 import { CredentialStoreRegistry, FullExecutionContext } from "@inkeep/agents-core";
 import * as ai0 from "ai";
 
@@ -44,7 +44,7 @@ declare function createDelegateToAgentTool({
   message: string;
 }, {
   toolCallId: any;
-  result: _inkeep_agents_core0.Message | _inkeep_agents_core0.Task;
+  result: _inkeep_agents_core1.Message | _inkeep_agents_core1.Task;
 }>;
 /**
  * Parameters for building a transfer relation config

package/dist/env.d.ts

@@ -14,11 +14,11 @@ declare const envSchema: z.ZodObject<{
     pentest: "pentest";
   }>>;
   LOG_LEVEL: z.ZodDefault<z.ZodEnum<{
+    error: "error";
     trace: "trace";
     debug: "debug";
     info: "info";
     warn: "warn";
-    error: "error";
   }>>;
   INKEEP_AGENTS_MANAGE_DATABASE_URL: z.ZodString;
   INKEEP_AGENTS_RUN_DATABASE_URL: z.ZodString;
@@ -53,7 +53,7 @@ declare const envSchema: z.ZodObject<{
 declare const env: {
   NODE_ENV: "development" | "production" | "test";
   ENVIRONMENT: "development" | "production" | "test" | "pentest";
-  LOG_LEVEL: "trace" | "debug" | "info" | "warn" | "error";
+  LOG_LEVEL: "error" | "trace" | "debug" | "info" | "warn";
   INKEEP_AGENTS_MANAGE_DATABASE_URL: string;
   INKEEP_AGENTS_RUN_DATABASE_URL: string;
   INKEEP_AGENTS_API_URL: string;

package/dist/factory.d.ts

@@ -3,7 +3,7 @@ import "./types/index.js";
 import { createAgentsHono } from "./createApp.js";
 import { initializeDefaultUser } from "./initialization.js";
 import { createAuth0Provider, createOIDCProvider } from "./ssoHelpers.js";
-import * as hono0 from "hono";
+import * as hono13 from "hono";
 import { CredentialStore, ServerConfig } from "@inkeep/agents-core";
 import * as zod0 from "zod";
 import { SSOProviderConfig, UserAuthConfig } from "@inkeep/agents-core/auth";
@@ -795,25 +795,25 @@ declare function createAgentsAuth(userAuthConfig?: UserAuthConfig): better_auth0
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -1104,25 +1104,25 @@ declare function createAgentsAuth(userAuthConfig?: UserAuthConfig): better_auth0
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -1536,6 +1536,6 @@ declare function createAgentsApp(config?: {
   auth?: UserAuthConfig;
   sandboxConfig?: SandboxConfig;
   skipInitialization?: boolean;
-}): hono0.Hono<hono_types1.BlankEnv, hono_types1.BlankSchema, "/">;
+}): hono13.Hono<hono_types1.BlankEnv, hono_types1.BlankSchema, "/">;
 //#endregion
 export { type SSOProviderConfig, type UserAuthConfig, createAgentsApp, createAgentsAuth, createAgentsHono, createAuth0Provider, createOIDCProvider, initializeDefaultUser };

package/dist/index.d.ts

@@ -796,25 +796,25 @@ declare const auth: better_auth78.Auth<{
       ac: better_auth_plugins69.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
         admin: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
         owner: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
       };
       membershipLimit: number;
@@ -1105,25 +1105,25 @@ declare const auth: better_auth78.Auth<{
       ac: better_auth_plugins69.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
         admin: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
         owner: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
       };
       membershipLimit: number;

package/dist/middleware/manageAuth.d.ts

@@ -1,4 +1,4 @@
-import * as hono1 from "hono";
+import * as hono0 from "hono";
 import { BaseExecutionContext } from "@inkeep/agents-core";
 import { createAuth } from "@inkeep/agents-core/auth";
 
@@ -12,7 +12,7 @@ import { createAuth } from "@inkeep/agents-core/auth";
  * 3. Database API key
  * 4. Internal service token
  */
-declare const manageApiKeyAuth: () => hono1.MiddlewareHandler<{
+declare const manageApiKeyAuth: () => hono0.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     userId?: string;

package/dist/middleware/projectAccess.d.ts

@@ -1,5 +1,5 @@
 import { ManageAppVariables } from "../types/app.js";
-import * as hono2 from "hono";
+import * as hono1 from "hono";
 
 //#region src/middleware/projectAccess.d.ts
 
@@ -26,6 +26,6 @@ declare const requireProjectPermission: <Env$1 extends {
   Variables: ManageAppVariables;
 } = {
   Variables: ManageAppVariables;
-}>(permission?: ProjectPermission) => hono2.MiddlewareHandler<Env$1, string, {}, Response>;
+}>(permission?: ProjectPermission) => hono1.MiddlewareHandler<Env$1, string, {}, Response>;
 //#endregion
 export { ProjectPermission, requireProjectPermission };

package/dist/middleware/projectConfig.d.ts

@@ -1,11 +1,11 @@
-import * as hono3 from "hono";
+import * as hono2 from "hono";
 import { BaseExecutionContext, ResolvedRef } from "@inkeep/agents-core";
 
 //#region src/middleware/projectConfig.d.ts
 /**
  * Middleware that fetches the full project definition from the Management API
  */
-declare const projectConfigMiddleware: hono3.MiddlewareHandler<{
+declare const projectConfigMiddleware: hono2.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     resolvedRef: ResolvedRef;
@@ -15,7 +15,7 @@ declare const projectConfigMiddleware: hono3.MiddlewareHandler<{
  * Creates a middleware that applies project config fetching except for specified route patterns
  * @param skipRouteCheck - Function that returns true if the route should skip the middleware
  */
-declare const projectConfigMiddlewareExcept: (skipRouteCheck: (path: string) => boolean) => hono3.MiddlewareHandler<{
+declare const projectConfigMiddlewareExcept: (skipRouteCheck: (path: string) => boolean) => hono2.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     resolvedRef: ResolvedRef;

package/dist/middleware/requirePermission.d.ts

@@ -1,5 +1,5 @@
 import { ManageAppVariables } from "../types/app.js";
-import * as hono5 from "hono";
+import * as hono4 from "hono";
 
 //#region src/middleware/requirePermission.d.ts
 type Permission = {
@@ -9,6 +9,6 @@ declare const requirePermission: <Env$1 extends {
   Variables: ManageAppVariables;
 } = {
   Variables: ManageAppVariables;
-}>(permissions: Permission) => hono5.MiddlewareHandler<Env$1, string, {}, Response>;
+}>(permissions: Permission) => hono4.MiddlewareHandler<Env$1, string, {}, Response>;
 //#endregion
 export { requirePermission };

package/dist/middleware/runAuth.d.ts

@@ -1,8 +1,8 @@
-import * as hono6 from "hono";
+import * as hono5 from "hono";
 import { BaseExecutionContext } from "@inkeep/agents-core";
 
 //#region src/middleware/runAuth.d.ts
-declare const runApiKeyAuth: () => hono6.MiddlewareHandler<{
+declare const runApiKeyAuth: () => hono5.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };
@@ -11,7 +11,7 @@ declare const runApiKeyAuth: () => hono6.MiddlewareHandler<{
  * Creates a middleware that applies API key authentication except for specified route patterns
  * @param skipRouteCheck - Function that returns true if the route should skip authentication
  */
-declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) => hono6.MiddlewareHandler<{
+declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) => hono5.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };
@@ -20,7 +20,7 @@ declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) =
  * Helper middleware for endpoints that optionally support API key authentication
  * If no auth header is present, it continues without setting the executionContext
  */
-declare const runOptionalAuth: () => hono6.MiddlewareHandler<{
+declare const runOptionalAuth: () => hono5.MiddlewareHandler<{
   Variables: {
     executionContext?: BaseExecutionContext;
   };

package/dist/middleware/sessionAuth.d.ts

@@ -1,4 +1,4 @@
-import * as hono9 from "hono";
+import * as hono8 from "hono";
 
 //#region src/middleware/sessionAuth.d.ts
 
@@ -7,11 +7,11 @@ import * as hono9 from "hono";
  * Requires that a user has already been authenticated via Better Auth session.
  * Used primarily for manage routes that require an active user session.
  */
-declare const sessionAuth: () => hono9.MiddlewareHandler<any, string, {}, Response>;
+declare const sessionAuth: () => hono8.MiddlewareHandler<any, string, {}, Response>;
 /**
  * Global session middleware - sets user and session in context for all routes
  * Used for all routes that require an active user session.
  */
-declare const sessionContext: () => hono9.MiddlewareHandler<any, string, {}, Response>;
+declare const sessionContext: () => hono8.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { sessionAuth, sessionContext };

package/dist/middleware/tenantAccess.d.ts

@@ -1,4 +1,4 @@
-import * as hono11 from "hono";
+import * as hono10 from "hono";
 
 //#region src/middleware/tenantAccess.d.ts
 
@@ -11,7 +11,7 @@ import * as hono11 from "hono";
  * - API key user: Access only to the tenant associated with the API key
  * - Session user: Access based on organization membership
  */
-declare const requireTenantAccess: () => hono11.MiddlewareHandler<{
+declare const requireTenantAccess: () => hono10.MiddlewareHandler<{
   Variables: {
     userId: string;
     tenantId: string;

package/dist/middleware/tracing.d.ts

@@ -1,7 +1,7 @@
-import * as hono12 from "hono";
+import * as hono11 from "hono";
 
 //#region src/middleware/tracing.d.ts
-declare const otelBaggageMiddleware: () => hono12.MiddlewareHandler<any, string, {}, Response>;
-declare const executionBaggageMiddleware: () => hono12.MiddlewareHandler<any, string, {}, Response>;
+declare const otelBaggageMiddleware: () => hono11.MiddlewareHandler<any, string, {}, Response>;
+declare const executionBaggageMiddleware: () => hono11.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { executionBaggageMiddleware, otelBaggageMiddleware };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkeep/agents-api",
-  "version": "0.0.0-dev-20260123202200",
+  "version": "0.0.0-dev-20260123205017",
   "description": "Unified Inkeep Agents API - combines management, runtime, and evaluation capabilities",
   "types": "dist/index.d.ts",
   "exports": {
@@ -71,8 +71,8 @@
     "openid-client": "^6.8.1",
     "pg": "^8.16.3",
     "workflow": "4.0.1-beta.33",
-    "@inkeep/agents-core": "^0.0.0-dev-20260123202200",
-    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20260123202200"
+    "@inkeep/agents-core": "^0.0.0-dev-20260123205017",
+    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20260123205017"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^1.1.5",