@inkeep/agents-api 0.0.0-dev-20260123202200 → 0.0.0-dev-20260123211824

package/dist/domains/run/agents/Agent.js

@@ -819,10 +819,12 @@ var Agent = class {
 					continue;
 				}
 				const zodSchema = jsonSchemaToZod(functionData.inputSchema);
+				const toolPolicies = functionToolDef.toolPolicies;
+				const needsApproval = !!toolPolicies?.["*"]?.needsApproval || !!toolPolicies?.[functionToolDef.name]?.needsApproval;
 				const aiTool = tool({
 					description: functionToolDef.description || functionToolDef.name,
 					inputSchema: zodSchema,
-					execute: async (args, { toolCallId }) => {
+					execute: async (args, { toolCallId, providerMetadata }) => {
 						let processedArgs;
 						try {
 							processedArgs = parseEmbeddedJson(args);
@@ -839,6 +841,95 @@ var Agent = class {
 							processedArgs = args;
 						}
 						const finalArgs = processedArgs;
+						if (needsApproval) {
+							logger.info({
+								toolName: functionToolDef.name,
+								toolCallId,
+								args: finalArgs
+							}, "Function tool requires approval - waiting for user response");
+							const currentSpan = trace.getActiveSpan();
+							if (currentSpan) currentSpan.addEvent("tool.approval.requested", {
+								"tool.name": functionToolDef.name,
+								"tool.callId": toolCallId,
+								"subAgent.id": this.config.id
+							});
+							tracer.startActiveSpan("tool.approval_requested", { attributes: {
+								"tool.name": functionToolDef.name,
+								"tool.callId": toolCallId,
+								"subAgent.id": this.config.id,
+								"subAgent.name": this.config.name
+							} }, (requestSpan) => {
+								requestSpan.setStatus({ code: SpanStatusCode.OK });
+								requestSpan.end();
+							});
+							const streamHelper = this.getStreamingHelper();
+							if (streamHelper) await streamHelper.writeToolApprovalRequest({
+								approvalId: `aitxt-${toolCallId}`,
+								toolCallId
+							});
+							else if (this.isDelegatedAgent) {
+								const streamRequestId$1 = this.getStreamRequestId();
+								if (streamRequestId$1) await toolApprovalUiBus.publish(streamRequestId$1, {
+									type: "approval-needed",
+									toolCallId,
+									toolName: functionToolDef.name,
+									input: finalArgs,
+									providerMetadata,
+									approvalId: `aitxt-${toolCallId}`
+								});
+							}
+							const approvalResult = await pendingToolApprovalManager.waitForApproval(toolCallId, functionToolDef.name, args, this.conversationId || "unknown", this.config.id);
+							if (!approvalResult.approved) {
+								if (!streamHelper && this.isDelegatedAgent) {
+									const streamRequestId$1 = this.getStreamRequestId();
+									if (streamRequestId$1) await toolApprovalUiBus.publish(streamRequestId$1, {
+										type: "approval-resolved",
+										toolCallId,
+										approved: false
+									});
+								}
+								return tracer.startActiveSpan("tool.approval_denied", { attributes: {
+									"tool.name": functionToolDef.name,
+									"tool.callId": toolCallId,
+									"subAgent.id": this.config.id,
+									"subAgent.name": this.config.name
+								} }, (denialSpan) => {
+									logger.info({
+										toolName: functionToolDef.name,
+										toolCallId,
+										reason: approvalResult.reason
+									}, "Function tool execution denied by user");
+									denialSpan.setStatus({ code: SpanStatusCode.OK });
+									denialSpan.end();
+									return {
+										__inkeepToolDenied: true,
+										toolCallId,
+										reason: approvalResult.reason
+									};
+								});
+							}
+							tracer.startActiveSpan("tool.approval_approved", { attributes: {
+								"tool.name": functionToolDef.name,
+								"tool.callId": toolCallId,
+								"subAgent.id": this.config.id,
+								"subAgent.name": this.config.name
+							} }, (approvedSpan) => {
+								logger.info({
+									toolName: functionToolDef.name,
+									toolCallId
+								}, "Function tool approved, continuing with execution");
+								approvedSpan.setStatus({ code: SpanStatusCode.OK });
+								approvedSpan.end();
+							});
+							if (!streamHelper && this.isDelegatedAgent) {
+								const streamRequestId$1 = this.getStreamRequestId();
+								if (streamRequestId$1) await toolApprovalUiBus.publish(streamRequestId$1, {
+									type: "approval-resolved",
+									toolCallId,
+									approved: true
+								});
+							}
+						}
 						logger.debug({
 							toolName: functionToolDef.name,
 							toolCallId,
@@ -876,7 +967,7 @@ var Agent = class {
 						}
 					}
 				});
-				functionTools[functionToolDef.name] = this.wrapToolWithStreaming(functionToolDef.name, aiTool, streamRequestId || "", "tool");
+				functionTools[functionToolDef.name] = this.wrapToolWithStreaming(functionToolDef.name, aiTool, streamRequestId || "", "tool", { needsApproval });
 			}
 		} catch (error) {
 			logger.error({ error }, "Failed to load function tools from database");

package/dist/domains/run/agents/relationTools.d.ts

@@ -1,6 +1,6 @@
 import { AgentConfig, DelegateRelation } from "./Agent.js";
 import { InternalRelation } from "../utils/project.js";
-import * as _inkeep_agents_core0 from "@inkeep/agents-core";
+import * as _inkeep_agents_core1 from "@inkeep/agents-core";
 import { CredentialStoreRegistry, FullExecutionContext } from "@inkeep/agents-core";
 import * as ai0 from "ai";
 
@@ -44,7 +44,7 @@ declare function createDelegateToAgentTool({
   message: string;
 }, {
   toolCallId: any;
-  result: _inkeep_agents_core0.Message | _inkeep_agents_core0.Task;
+  result: _inkeep_agents_core1.Message | _inkeep_agents_core1.Task;
 }>;
 /**
  * Parameters for building a transfer relation config

package/dist/factory.d.ts

@@ -7,7 +7,7 @@ import * as hono0 from "hono";
 import { CredentialStore, ServerConfig } from "@inkeep/agents-core";
 import * as zod0 from "zod";
 import { SSOProviderConfig, UserAuthConfig } from "@inkeep/agents-core/auth";
-import * as hono_types1 from "hono/types";
+import * as hono_types0 from "hono/types";
 import * as better_auth0 from "better-auth";
 import * as better_auth_plugins0 from "better-auth/plugins";
 import * as _better_auth_sso0 from "@better-auth/sso";
@@ -795,25 +795,25 @@ declare function createAgentsAuth(userAuthConfig?: UserAuthConfig): better_auth0
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -840,13 +840,13 @@ declare function createAgentsAuth(userAuthConfig?: UserAuthConfig): better_auth0
           user: better_auth0.User & Record<string, any>;
           organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
-        afterUpdateMemberRole: ({
+        beforeUpdateMemberRole: ({
           member,
           organization: org,
-          previousRole
+          newRole
         }: {
           member: better_auth_plugins0.Member & Record<string, any>;
-          previousRole: string;
+          newRole: string;
           user: better_auth0.User & Record<string, any>;
           organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
@@ -1104,25 +1104,25 @@ declare function createAgentsAuth(userAuthConfig?: UserAuthConfig): better_auth0
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins0.Statements>;
         };
       };
       membershipLimit: number;
@@ -1149,13 +1149,13 @@ declare function createAgentsAuth(userAuthConfig?: UserAuthConfig): better_auth0
           user: better_auth0.User & Record<string, any>;
           organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
-        afterUpdateMemberRole: ({
+        beforeUpdateMemberRole: ({
           member,
           organization: org,
-          previousRole
+          newRole
         }: {
           member: better_auth_plugins0.Member & Record<string, any>;
-          previousRole: string;
+          newRole: string;
           user: better_auth0.User & Record<string, any>;
           organization: better_auth_plugins0.Organization & Record<string, any>;
         }) => Promise<void>;
@@ -1536,6 +1536,6 @@ declare function createAgentsApp(config?: {
   auth?: UserAuthConfig;
   sandboxConfig?: SandboxConfig;
   skipInitialization?: boolean;
-}): hono0.Hono<hono_types1.BlankEnv, hono_types1.BlankSchema, "/">;
+}): hono0.Hono<hono_types0.BlankEnv, hono_types0.BlankSchema, "/">;
 //#endregion
 export { type SSOProviderConfig, type UserAuthConfig, createAgentsApp, createAgentsAuth, createAgentsHono, createAuth0Provider, createOIDCProvider, initializeDefaultUser };

package/dist/index.d.ts

@@ -8,7 +8,7 @@ import { createAuth0Provider, createOIDCProvider } from "./ssoHelpers.js";
 import { SSOProviderConfig, UserAuthConfig, createAgentsApp } from "./factory.js";
 import { Hono } from "hono";
 import * as zod205 from "zod";
-import * as hono_types3 from "hono/types";
+import * as hono_types1 from "hono/types";
 import * as better_auth78 from "better-auth";
 import * as better_auth_plugins69 from "better-auth/plugins";
 import * as _better_auth_sso10 from "@better-auth/sso";
@@ -796,25 +796,25 @@ declare const auth: better_auth78.Auth<{
       ac: better_auth_plugins69.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
         admin: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
         owner: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
       };
       membershipLimit: number;
@@ -841,13 +841,13 @@ declare const auth: better_auth78.Auth<{
           user: better_auth78.User & Record<string, any>;
           organization: better_auth_plugins69.Organization & Record<string, any>;
         }) => Promise<void>;
-        afterUpdateMemberRole: ({
+        beforeUpdateMemberRole: ({
           member,
           organization: org,
-          previousRole
+          newRole
         }: {
           member: better_auth_plugins69.Member & Record<string, any>;
-          previousRole: string;
+          newRole: string;
           user: better_auth78.User & Record<string, any>;
           organization: better_auth_plugins69.Organization & Record<string, any>;
         }) => Promise<void>;
@@ -1105,25 +1105,25 @@ declare const auth: better_auth78.Auth<{
       ac: better_auth_plugins69.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
         admin: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
         owner: {
-          authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "team" | "ac">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "project" | "team" | "ac", better_auth_plugins69.Statements>;
         };
       };
       membershipLimit: number;
@@ -1150,13 +1150,13 @@ declare const auth: better_auth78.Auth<{
           user: better_auth78.User & Record<string, any>;
           organization: better_auth_plugins69.Organization & Record<string, any>;
         }) => Promise<void>;
-        afterUpdateMemberRole: ({
+        beforeUpdateMemberRole: ({
           member,
           organization: org,
-          previousRole
+          newRole
         }: {
           member: better_auth_plugins69.Member & Record<string, any>;
-          previousRole: string;
+          newRole: string;
           user: better_auth78.User & Record<string, any>;
           organization: better_auth_plugins69.Organization & Record<string, any>;
         }) => Promise<void>;
@@ -1531,6 +1531,6 @@ declare const auth: better_auth78.Auth<{
     }>;
   }];
 }> | null;
-declare const app: Hono<hono_types3.BlankEnv, hono_types3.BlankSchema, "/">;
+declare const app: Hono<hono_types1.BlankEnv, hono_types1.BlankSchema, "/">;
 //#endregion
 export { type AppConfig, type AppVariables, Hono, type NativeSandboxConfig, type SSOProviderConfig, type SandboxConfig, type UserAuthConfig, type VercelSandboxConfig, auth, createAgentsApp, createAgentsHono, createAuth0Provider, createOIDCProvider, app as default, initializeDefaultUser };

package/dist/initialization.js

@@ -1,7 +1,7 @@
 import { getLogger as getLogger$1 } from "./logger.js";
 import { env } from "./env.js";
 import runDbClient_default from "./data/db/runDbClient.js";
-import { addUserToOrganization, getUserByEmail, upsertOrganization } from "@inkeep/agents-core";
+import { OrgRoles, addUserToOrganization, getUserByEmail, upsertOrganization } from "@inkeep/agents-core";
 
 //#region src/initialization.ts
 const logger = getLogger$1("initialization");
@@ -45,7 +45,7 @@ async function initializeDefaultUser(authInstance) {
 		await addUserToOrganization(runDbClient_default)({
 			userId: user.id,
 			organizationId: orgId,
-			role: "owner"
+			role: OrgRoles.ADMIN
 		});
 		logger.info({
 			organizationId: orgId,

package/dist/middleware/evalsAuth.d.ts

@@ -1,4 +1,4 @@
-import * as hono0 from "hono";
+import * as hono4 from "hono";
 import { BaseExecutionContext } from "@inkeep/agents-core";
 
 //#region src/middleware/evalsAuth.d.ts
@@ -7,7 +7,7 @@ import { BaseExecutionContext } from "@inkeep/agents-core";
  * Middleware to authenticate API requests using Bearer token authentication
  * First checks if token matches INKEEP_AGENTS_EVAL_API_BYPASS_SECRET,
  */
-declare const evalApiKeyAuth: () => hono0.MiddlewareHandler<{
+declare const evalApiKeyAuth: () => hono4.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };

package/dist/middleware/manageAuth.d.ts

@@ -1,4 +1,4 @@
-import * as hono1 from "hono";
+import * as hono0 from "hono";
 import { BaseExecutionContext } from "@inkeep/agents-core";
 import { createAuth } from "@inkeep/agents-core/auth";
 
@@ -12,7 +12,7 @@ import { createAuth } from "@inkeep/agents-core/auth";
  * 3. Database API key
  * 4. Internal service token
  */
-declare const manageApiKeyAuth: () => hono1.MiddlewareHandler<{
+declare const manageApiKeyAuth: () => hono0.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     userId?: string;

package/dist/middleware/projectAccess.d.ts

@@ -1,16 +1,9 @@
 import { ManageAppVariables } from "../types/app.js";
-import * as hono2 from "hono";
+import * as hono1 from "hono";
+import { ProjectPermissionLevel } from "@inkeep/agents-core";
 
 //#region src/middleware/projectAccess.d.ts
 
-/**
- * Permission levels for project access
- *
- * - view: Can see project and resources (read-only)
- * - use: Can invoke agents, create API keys, view traces
- * - edit: Can modify configurations and manage members
- */
-type ProjectPermission = 'view' | 'use' | 'edit';
 /**
  * Middleware to check project-level access.
  *
@@ -26,6 +19,6 @@ declare const requireProjectPermission: <Env$1 extends {
   Variables: ManageAppVariables;
 } = {
   Variables: ManageAppVariables;
-}>(permission?: ProjectPermission) => hono2.MiddlewareHandler<Env$1, string, {}, Response>;
+}>(permission?: ProjectPermissionLevel) => hono1.MiddlewareHandler<Env$1, string, {}, Response>;
 //#endregion
-export { ProjectPermission, requireProjectPermission };
+export { requireProjectPermission };

package/dist/middleware/projectAccess.js

@@ -44,7 +44,6 @@ const requireProjectPermission = (permission = "view") => createMiddleware(async
 		switch (permission) {
 			case "view":
 				hasAccess = await canViewProject({
-					tenantId,
 					userId,
 					projectId,
 					orgRole: tenantRole
@@ -52,7 +51,6 @@ const requireProjectPermission = (permission = "view") => createMiddleware(async
 				break;
 			case "use":
 				hasAccess = await canUseProject({
-					tenantId,
 					userId,
 					projectId,
 					orgRole: tenantRole
@@ -60,7 +58,6 @@ const requireProjectPermission = (permission = "view") => createMiddleware(async
 				break;
 			case "edit":
 				hasAccess = await canEditProject({
-					tenantId,
 					userId,
 					projectId,
 					orgRole: tenantRole
@@ -68,20 +65,7 @@ const requireProjectPermission = (permission = "view") => createMiddleware(async
 				break;
 		}
 		if (!hasAccess) {
-			if (isAuthzEnabled(tenantId) && permission !== "view") {
-				if (await canViewProject({
-					tenantId,
-					userId,
-					projectId,
-					orgRole: tenantRole
-				})) throw createApiError({
-					code: "forbidden",
-					message: `Permission denied. Required: project:${permission}`,
-					instance: c.req.path,
-					extensions: { requiredPermissions: [`project:${permission}`] }
-				});
-			}
-			if (isAuthzEnabled(tenantId)) throw createApiError({
+			if (isAuthzEnabled()) throw createApiError({
 				code: "not_found",
 				message: "Project not found",
 				instance: c.req.path

package/dist/middleware/projectConfig.d.ts

@@ -1,11 +1,11 @@
-import * as hono3 from "hono";
+import * as hono2 from "hono";
 import { BaseExecutionContext, ResolvedRef } from "@inkeep/agents-core";
 
 //#region src/middleware/projectConfig.d.ts
 /**
  * Middleware that fetches the full project definition from the Management API
  */
-declare const projectConfigMiddleware: hono3.MiddlewareHandler<{
+declare const projectConfigMiddleware: hono2.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     resolvedRef: ResolvedRef;
@@ -15,7 +15,7 @@ declare const projectConfigMiddleware: hono3.MiddlewareHandler<{
  * Creates a middleware that applies project config fetching except for specified route patterns
  * @param skipRouteCheck - Function that returns true if the route should skip the middleware
  */
-declare const projectConfigMiddlewareExcept: (skipRouteCheck: (path: string) => boolean) => hono3.MiddlewareHandler<{
+declare const projectConfigMiddlewareExcept: (skipRouteCheck: (path: string) => boolean) => hono2.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     resolvedRef: ResolvedRef;

package/dist/middleware/tenantAccess.js

@@ -1,5 +1,5 @@
 import runDbClient_default from "../data/db/runDbClient.js";
-import { createApiError, getUserOrganizations } from "@inkeep/agents-core";
+import { OrgRoles, createApiError, getUserOrganizationsFromDb } from "@inkeep/agents-core";
 import { createMiddleware } from "hono/factory";
 import { HTTPException } from "hono/http-exception";
 
@@ -26,7 +26,7 @@ const requireTenantAccess = () => createMiddleware(async (c, next) => {
 	});
 	if (userId === "system") {
 		c.set("tenantId", tenantId);
-		c.set("tenantRole", "owner");
+		c.set("tenantRole", OrgRoles.OWNER);
 		await next();
 		return;
 	}
@@ -37,12 +37,12 @@ const requireTenantAccess = () => createMiddleware(async (c, next) => {
 			message: "API key does not have access to this organization"
 		});
 		c.set("tenantId", tenantId);
-		c.set("tenantRole", "owner");
+		c.set("tenantRole", OrgRoles.OWNER);
 		await next();
 		return;
 	}
 	try {
-		const organizationAccess = (await getUserOrganizations(runDbClient_default)(userId)).find((org) => org.organizationId === tenantId);
+		const organizationAccess = (await getUserOrganizationsFromDb(runDbClient_default)(userId)).find((org) => org.organizationId === tenantId);
 		if (!organizationAccess) throw createApiError({
 			code: "forbidden",
 			message: "Access denied to this organization"

package/dist/types/app.d.ts

@@ -38,6 +38,8 @@ type ManageAppVariables = AppVariables & {
   db: AgentsManageDatabaseClient;
   auth: ReturnType<typeof createAuth> | null;
   resolvedRef: ResolvedRef;
+  /** Cached by projectFull middleware to avoid duplicate DB lookup for PUT upsert */
+  isProjectCreate?: boolean;
 };
 type AppConfig = {
   serverConfig: ServerConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkeep/agents-api",
-  "version": "0.0.0-dev-20260123202200",
+  "version": "0.0.0-dev-20260123211824",
   "description": "Unified Inkeep Agents API - combines management, runtime, and evaluation capabilities",
   "types": "dist/index.d.ts",
   "exports": {
@@ -71,8 +71,8 @@
     "openid-client": "^6.8.1",
     "pg": "^8.16.3",
     "workflow": "4.0.1-beta.33",
-    "@inkeep/agents-core": "^0.0.0-dev-20260123202200",
-    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20260123202200"
+    "@inkeep/agents-core": "^0.0.0-dev-20260123211824",
+    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20260123211824"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^1.1.5",