@inkeep/agents-api 0.0.0-dev-20260204091343 → 0.0.0-dev-20260204160325

package/dist/domains/evals/routes/datasetTriggers.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono14 from "hono";
+import * as hono12 from "hono";
 
 //#region src/domains/evals/routes/datasetTriggers.d.ts
-declare const app: OpenAPIHono<hono14.Env, {}, "/">;
+declare const app: OpenAPIHono<hono12.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/index.js

@@ -1,3 +1,4 @@
+import availableAgents_default from "./routes/availableAgents.js";
 import cliAuth_default from "./routes/cliAuth.js";
 import github_default from "./routes/github.js";
 import routes_default from "./routes/index.js";
@@ -27,6 +28,7 @@ function createManageRoutes() {
 	app.route("/tenants/:tenantId", projectFull_default);
 	app.route("/oauth", oauth_default);
 	app.route("/mcp", mcp_default);
+	app.route("/available-agents", availableAgents_default);
 	return app;
 }
 const manageRoutes = createManageRoutes();

package/dist/domains/manage/routes/availableAgents.d.ts

@@ -0,0 +1,7 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import * as hono17 from "hono";
+
+//#region src/domains/manage/routes/availableAgents.d.ts
+declare const app: OpenAPIHono<hono17.Env, {}, "/">;
+//#endregion
+export { app as default };

package/dist/domains/manage/routes/availableAgents.js

@@ -0,0 +1,94 @@
+import { getLogger as getLogger$1 } from "../../../logger.js";
+import { env } from "../../../env.js";
+import manageDbClient_default from "../../../data/db/manageDbClient.js";
+import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { createApiError, listAgentsAcrossProjectBranches, listUsableProjectIds, verifyTempToken } from "@inkeep/agents-core";
+
+//#region src/domains/manage/routes/availableAgents.ts
+const logger = getLogger$1("availableAgents");
+const app = new OpenAPIHono();
+async function tryTempTokenAuth(token) {
+	if (!env.INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY) return null;
+	try {
+		const payload = await verifyTempToken(Buffer.from(env.INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY, "base64").toString("utf-8"), token);
+		return {
+			userId: payload.sub,
+			tenantId: payload.tenantId,
+			tokenType: "temp-jwt"
+		};
+	} catch (error) {
+		logger.warn({
+			token,
+			error
+		}, "Failed to verify temp token");
+		return null;
+	}
+}
+/**
+* Identify user from any supported token type
+* Add new token types by adding them to this function
+*/
+async function identifyUserFromToken(token) {
+	const tempResult = await tryTempTokenAuth(token);
+	if (tempResult) return tempResult;
+	return null;
+}
+const AvailableAgentSchema = z.object({
+	agentId: z.string(),
+	agentName: z.string(),
+	projectId: z.string()
+});
+const AvailableAgentsResponseSchema = z.object({ data: z.array(AvailableAgentSchema) });
+app.openapi(createRoute({
+	method: "get",
+	path: "/",
+	summary: "List available agents",
+	operationId: "list-available-agents",
+	tags: ["Agents"],
+	description: "List all agents the user can invoke. Requires a valid JWT token.",
+	security: [{ bearerAuth: [] }],
+	responses: {
+		200: {
+			description: "List of available agents",
+			content: { "application/json": { schema: AvailableAgentsResponseSchema } }
+		},
+		401: { description: "Unauthorized - invalid or missing JWT token" },
+		500: { description: "Internal server error" }
+	}
+}), async (c) => {
+	const authHeader = c.req.header("Authorization");
+	if (!authHeader?.startsWith("Bearer ")) throw createApiError({
+		code: "unauthorized",
+		message: "Missing or invalid authorization header. Expected: Bearer <jwt_token>"
+	});
+	const token = authHeader.substring(7);
+	if (!token.startsWith("eyJ")) throw createApiError({
+		code: "unauthorized",
+		message: "Invalid token format. Expected a JWT token."
+	});
+	const user = await identifyUserFromToken(token);
+	if (!user) {
+		logger.warn({}, "Token verification failed - no valid auth method found");
+		throw createApiError({
+			code: "unauthorized",
+			message: "Invalid or expired token"
+		});
+	}
+	const { userId, tenantId } = user;
+	const projectIds = await listUsableProjectIds({ userId });
+	if (projectIds.length === 0) return c.json({ data: [] });
+	const agents = await listAgentsAcrossProjectBranches(manageDbClient_default, {
+		tenantId,
+		projectIds
+	});
+	logger.info({
+		userId,
+		tenantId,
+		agentCount: agents.length
+	}, "Returning usable agents");
+	return c.json({ data: agents });
+});
+var availableAgents_default = app;
+
+//#endregion
+export { availableAgents_default as default };

package/dist/domains/manage/routes/conversations.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono16 from "hono";
+import * as hono18 from "hono";
 
 //#region src/domains/manage/routes/conversations.d.ts
-declare const app: OpenAPIHono<hono16.Env, {}, "/">;
+declare const app: OpenAPIHono<hono18.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/index.d.ts

@@ -1,7 +1,7 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import * as hono17 from "hono";
+import * as hono16 from "hono";
 
 //#region src/domains/manage/routes/index.d.ts
-declare const app: OpenAPIHono<hono17.Env, {}, "/">;
+declare const app: OpenAPIHono<hono16.Env, {}, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/invitations.d.ts

@@ -1,10 +1,10 @@
 import { ManageAppVariables } from "../../../types/app.js";
 import { Hono } from "hono";
-import * as hono_types11 from "hono/types";
+import * as hono_types10 from "hono/types";
 
 //#region src/domains/manage/routes/invitations.d.ts
 declare const invitationsRoutes: Hono<{
   Variables: ManageAppVariables;
-}, hono_types11.BlankSchema, "/">;
+}, hono_types10.BlankSchema, "/">;
 //#endregion
 export { invitationsRoutes as default };

package/dist/domains/manage/routes/mcp.d.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
-import * as hono_types12 from "hono/types";
+import * as hono_types11 from "hono/types";
 
 //#region src/domains/manage/routes/mcp.d.ts
-declare const app: Hono<hono_types12.BlankEnv, hono_types12.BlankSchema, "/">;
+declare const app: Hono<hono_types11.BlankEnv, hono_types11.BlankSchema, "/">;
 //#endregion
 export { app as default };

package/dist/domains/manage/routes/playgroundToken.js

@@ -109,8 +109,9 @@ app.openapi(createRoute({
 		initiatedBy: {
 			type: "user",
 			id: userId
-		}
-	}, userId);
+		},
+		sub: userId
+	});
 	logger.info({
 		userId,
 		expiresAt: result.expiresAt

package/dist/domains/manage/routes/userOrganizations.d.ts

@@ -1,10 +1,10 @@
 import { ManageAppVariables } from "../../../types/app.js";
 import { Hono } from "hono";
-import * as hono_types8 from "hono/types";
+import * as hono_types13 from "hono/types";
 
 //#region src/domains/manage/routes/userOrganizations.d.ts
 declare const userOrganizationsRoutes: Hono<{
   Variables: ManageAppVariables;
-}, hono_types8.BlankSchema, "/">;
+}, hono_types13.BlankSchema, "/">;
 //#endregion
 export { userOrganizationsRoutes as default };

package/dist/domains/mcp/routes/mcp.d.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
-import * as hono_types9 from "hono/types";
+import * as hono_types8 from "hono/types";
 
 //#region src/domains/mcp/routes/mcp.d.ts
-declare const app: Hono<hono_types9.BlankEnv, hono_types9.BlankSchema, "/">;
+declare const app: Hono<hono_types8.BlankEnv, hono_types8.BlankSchema, "/">;
 //#endregion
 export { app as default };

package/dist/domains/run/agents/relationTools.js

@@ -140,7 +140,8 @@ function createDelegateToAgentTool({ delegateConfig, callingAgentId, executionCo
 			if (activeSpan) activeSpan.setAttributes({
 				[SPAN_KEYS.DELEGATION_FROM_SUB_AGENT_ID]: callingAgentId,
 				[SPAN_KEYS.DELEGATION_TO_SUB_AGENT_ID]: delegateConfig.config.id ?? "unknown",
-				[SPAN_KEYS.DELEGATION_ID]: delegationId
+				[SPAN_KEYS.DELEGATION_ID]: delegationId,
+				[SPAN_KEYS.DELEGATION_TYPE]: delegateConfig.type
 			});
 			if (metadata.streamRequestId) agentSessionManager.recordEvent(metadata.streamRequestId, "delegation_sent", callingAgentId, {
 				delegationId,

package/dist/factory.d.ts

@@ -794,25 +794,25 @@ declare function createAgentsAuth(userAuthConfig?: UserAuthConfig): better_auth0
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>;
         };
       };
       creatorRole: "admin";
@@ -1104,25 +1104,25 @@ declare function createAgentsAuth(userAuthConfig?: UserAuthConfig): better_auth0
       ac: better_auth_plugins0.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key] | {
-            actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key] | {
+            actions: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-          statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins0.Statements>;
+          statements: better_auth_plugins0.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins0.Statements>;
         };
       };
       creatorRole: "admin";

package/dist/index.d.ts

@@ -795,25 +795,25 @@ declare const auth: better_auth78.Auth<{
       ac: better_auth_plugins69.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>;
         };
       };
       creatorRole: "admin";
@@ -1105,25 +1105,25 @@ declare const auth: better_auth78.Auth<{
       ac: better_auth_plugins69.AccessControl;
       roles: {
         member: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>;
         };
         admin: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>;
         };
         owner: {
-          authorize<K_1 extends "organization" | "member" | "invitation" | "ac" | "project" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key] | {
-            actions: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>[key];
+          authorize<K_1 extends "organization" | "ac" | "member" | "project" | "team" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key] | {
+            actions: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>[key];
             connector: "OR" | "AND";
           } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins69.AuthorizeResponse;
-          statements: better_auth_plugins69.Subset<"organization" | "member" | "invitation" | "ac" | "project" | "team", better_auth_plugins69.Statements>;
+          statements: better_auth_plugins69.Subset<"organization" | "ac" | "member" | "project" | "team" | "invitation", better_auth_plugins69.Statements>;
         };
       };
       creatorRole: "admin";

package/dist/middleware/evalsAuth.d.ts

@@ -1,5 +1,5 @@
 import { BaseExecutionContext } from "@inkeep/agents-core";
-import * as hono1 from "hono";
+import * as hono0 from "hono";
 
 //#region src/middleware/evalsAuth.d.ts
 
@@ -7,7 +7,7 @@ import * as hono1 from "hono";
  * Middleware to authenticate API requests using Bearer token authentication
  * First checks if token matches INKEEP_AGENTS_EVAL_API_BYPASS_SECRET,
  */
-declare const evalApiKeyAuth: () => hono1.MiddlewareHandler<{
+declare const evalApiKeyAuth: () => hono0.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };

package/dist/middleware/manageAuth.d.ts

@@ -1,5 +1,5 @@
 import { BaseExecutionContext } from "@inkeep/agents-core";
-import * as hono2 from "hono";
+import * as hono1 from "hono";
 import { createAuth } from "@inkeep/agents-core/auth";
 
 //#region src/middleware/manageAuth.d.ts
@@ -12,7 +12,7 @@ import { createAuth } from "@inkeep/agents-core/auth";
  * 3. Database API key
  * 4. Internal service token
  */
-declare const manageApiKeyAuth: () => hono2.MiddlewareHandler<{
+declare const manageApiKeyAuth: () => hono1.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     userId?: string;

package/dist/middleware/projectAccess.d.ts

@@ -1,6 +1,6 @@
 import { ManageAppVariables } from "../types/app.js";
 import { ProjectPermissionLevel } from "@inkeep/agents-core";
-import * as hono0 from "hono";
+import * as hono2 from "hono";
 
 //#region src/middleware/projectAccess.d.ts
 /**
@@ -10,6 +10,6 @@ declare const requireProjectPermission: <Env$1 extends {
   Variables: ManageAppVariables;
 } = {
   Variables: ManageAppVariables;
-}>(permission?: ProjectPermissionLevel) => hono0.MiddlewareHandler<Env$1, string, {}, Response>;
+}>(permission?: ProjectPermissionLevel) => hono2.MiddlewareHandler<Env$1, string, {}, Response>;
 //#endregion
 export { requireProjectPermission };

package/dist/middleware/runAuth.js

@@ -2,7 +2,7 @@ import { getLogger as getLogger$1 } from "../logger.js";
 import { env } from "../env.js";
 import runDbClient_default from "../data/db/runDbClient.js";
 import { createBaseExecutionContext } from "../types/runExecutionContext.js";
-import { validateAndGetApiKey, validateTargetAgent, verifyServiceToken, verifyTempToken } from "@inkeep/agents-core";
+import { canUseProjectStrict, validateAndGetApiKey, validateTargetAgent, verifyServiceToken, verifyTempToken } from "@inkeep/agents-core";
 import { createMiddleware } from "hono/factory";
 import { HTTPException } from "hono/http-exception";
 
@@ -51,21 +51,56 @@ function buildExecutionContext(authResult, reqData) {
 }
 /**
 * Attempts to authenticate using a JWT temporary token
+*
+* Throws HTTPException(403) if the JWT is valid but the user lacks permission.
+* Returns null if the token is not a temp JWT (allowing fallback to other auth methods).
 */
 async function tryTempJwtAuth(apiKey) {
 	if (!apiKey.startsWith("eyJ") || !env.INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY) return null;
 	try {
 		const payload = await verifyTempToken(Buffer.from(env.INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY, "base64").toString("utf-8"), apiKey);
-		logger.info({}, "JWT temp token authenticated successfully");
+		const userId = payload.sub;
+		const projectId = payload.projectId;
+		const agentId = payload.agentId;
+		if (!projectId || !agentId) {
+			logger.warn({ userId }, "Missing projectId or agentId in JWT");
+			throw new HTTPException(400, { message: "Invalid token: missing projectId or agentId" });
+		}
+		let canUse;
+		try {
+			canUse = await canUseProjectStrict({
+				userId,
+				projectId
+			});
+		} catch (error) {
+			logger.error({
+				error,
+				userId,
+				projectId
+			}, "SpiceDB permission check failed");
+			throw new HTTPException(503, { message: "Authorization service temporarily unavailable" });
+		}
+		if (!canUse) {
+			logger.warn({
+				userId,
+				projectId
+			}, "User does not have use permission on project");
+			throw new HTTPException(403, { message: "Access denied: insufficient permissions" });
+		}
+		logger.info({
+			projectId,
+			agentId
+		}, "JWT temp token authenticated successfully");
 		return {
 			apiKey,
 			tenantId: payload.tenantId,
-			projectId: payload.projectId,
-			agentId: payload.agentId,
+			projectId,
+			agentId,
 			apiKeyId: "temp-jwt",
 			metadata: { initiatedBy: payload.initiatedBy }
 		};
 	} catch (error) {
+		if (error instanceof HTTPException) throw error;
 		logger.debug({ error }, "JWT verification failed");
 		return null;
 	}

package/dist/middleware/tracing.d.ts

@@ -1,7 +1,7 @@
-import * as hono12 from "hono";
+import * as hono13 from "hono";
 
 //#region src/middleware/tracing.d.ts
-declare const otelBaggageMiddleware: () => hono12.MiddlewareHandler<any, string, {}, Response>;
-declare const executionBaggageMiddleware: () => hono12.MiddlewareHandler<any, string, {}, Response>;
+declare const otelBaggageMiddleware: () => hono13.MiddlewareHandler<any, string, {}, Response>;
+declare const executionBaggageMiddleware: () => hono13.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { executionBaggageMiddleware, otelBaggageMiddleware };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkeep/agents-api",
-  "version": "0.0.0-dev-20260204091343",
+  "version": "0.0.0-dev-20260204160325",
   "description": "Unified Inkeep Agents API - combines management, runtime, and evaluation capabilities",
   "types": "dist/index.d.ts",
   "exports": {
@@ -66,10 +66,10 @@
     "openid-client": "^6.8.1",
     "pg": "^8.16.3",
     "workflow": "4.0.1-beta.33",
-    "@inkeep/agents-core": "^0.0.0-dev-20260204091343",
-    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20260204091343",
-    "@inkeep/agents-mcp": "^0.0.0-dev-20260204091343",
-    "@inkeep/agents-work-apps": "^0.0.0-dev-20260204091343"
+    "@inkeep/agents-core": "^0.0.0-dev-20260204160325",
+    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20260204160325",
+    "@inkeep/agents-mcp": "^0.0.0-dev-20260204160325",
+    "@inkeep/agents-work-apps": "^0.0.0-dev-20260204160325"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^1.1.5",