@inkeep/agents-api 0.0.0-dev-20260211191741 → 0.0.0-dev-20260211220939

package/dist/middleware/cors.js

@@ -141,6 +141,32 @@ const signozCorsConfig = {
 	maxAge: 600,
 	credentials: true
 };
+/**
+* CORS configuration for work-apps routes (Slack, etc.)
+* Needs to allow cross-origin requests with credentials for dashboard integration
+*/
+const workAppsCorsConfig = {
+	origin: originHandler,
+	allowHeaders: [
+		"content-type",
+		"Content-Type",
+		"authorization",
+		"Authorization",
+		"User-Agent",
+		"Cookie"
+	],
+	allowMethods: [
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"OPTIONS",
+		"PATCH"
+	],
+	exposeHeaders: ["Content-Length"],
+	maxAge: 600,
+	credentials: true
+};
 
 //#endregion
-export { authCorsConfig, defaultCorsConfig, getBaseDomain, getRootDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig };
+export { authCorsConfig, defaultCorsConfig, getBaseDomain, getRootDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig, workAppsCorsConfig };

package/dist/middleware/evalsAuth.d.ts

@@ -1,5 +1,5 @@
 import { BaseExecutionContext } from "@inkeep/agents-core";
-import * as hono6 from "hono";
+import * as hono0 from "hono";
 
 //#region src/middleware/evalsAuth.d.ts
 
@@ -7,7 +7,7 @@ import * as hono6 from "hono";
  * Middleware to authenticate API requests using Bearer token authentication
  * First checks if token matches INKEEP_AGENTS_EVAL_API_BYPASS_SECRET,
  */
-declare const evalApiKeyAuth: () => hono6.MiddlewareHandler<{
+declare const evalApiKeyAuth: () => hono0.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };

package/dist/middleware/index.d.ts

@@ -1,8 +1,9 @@
-import { authCorsConfig, defaultCorsConfig, getBaseDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig } from "./cors.js";
+import { authCorsConfig, defaultCorsConfig, getBaseDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig, workAppsCorsConfig } from "./cors.js";
 import { errorHandler } from "./errorHandler.js";
 import { manageApiKeyAuth } from "./manageAuth.js";
 import { oauthRefMiddleware } from "./ref.js";
 import { runApiKeyAuth, runApiKeyAuthExcept, runOptionalAuth } from "./runAuth.js";
 import { sessionAuth } from "./sessionAuth.js";
 import { requireTenantAccess } from "./tenantAccess.js";
-export { authCorsConfig, defaultCorsConfig, errorHandler, getBaseDomain, isOriginAllowed, manageApiKeyAuth, oauthRefMiddleware, playgroundCorsConfig, requireTenantAccess, runApiKeyAuth, runApiKeyAuthExcept, runCorsConfig, runOptionalAuth, sessionAuth, signozCorsConfig };
+import { workAppsAuth } from "./workAppsAuth.js";
+export { authCorsConfig, defaultCorsConfig, errorHandler, getBaseDomain, isOriginAllowed, manageApiKeyAuth, oauthRefMiddleware, playgroundCorsConfig, requireTenantAccess, runApiKeyAuth, runApiKeyAuthExcept, runCorsConfig, runOptionalAuth, sessionAuth, signozCorsConfig, workAppsAuth, workAppsCorsConfig };

package/dist/middleware/index.js

@@ -1,9 +1,10 @@
 import { sessionAuth } from "./sessionAuth.js";
-import { authCorsConfig, defaultCorsConfig, getBaseDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig } from "./cors.js";
+import { authCorsConfig, defaultCorsConfig, getBaseDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig, workAppsCorsConfig } from "./cors.js";
 import { errorHandler } from "./errorHandler.js";
 import { manageApiKeyAuth } from "./manageAuth.js";
 import { oauthRefMiddleware } from "./ref.js";
 import { runApiKeyAuth, runApiKeyAuthExcept, runOptionalAuth } from "./runAuth.js";
 import { requireTenantAccess } from "./tenantAccess.js";
+import { workAppsAuth } from "./workAppsAuth.js";
 
-export { authCorsConfig, defaultCorsConfig, errorHandler, getBaseDomain, isOriginAllowed, manageApiKeyAuth, oauthRefMiddleware, playgroundCorsConfig, requireTenantAccess, runApiKeyAuth, runApiKeyAuthExcept, runCorsConfig, runOptionalAuth, sessionAuth, signozCorsConfig };
+export { authCorsConfig, defaultCorsConfig, errorHandler, getBaseDomain, isOriginAllowed, manageApiKeyAuth, oauthRefMiddleware, playgroundCorsConfig, requireTenantAccess, runApiKeyAuth, runApiKeyAuthExcept, runCorsConfig, runOptionalAuth, sessionAuth, signozCorsConfig, workAppsAuth, workAppsCorsConfig };

package/dist/middleware/manageAuth.d.ts

@@ -1,5 +1,5 @@
 import { BaseExecutionContext } from "@inkeep/agents-core";
-import * as hono4 from "hono";
+import * as hono1 from "hono";
 import { createAuth } from "@inkeep/agents-core/auth";
 
 //#region src/middleware/manageAuth.d.ts
@@ -12,7 +12,7 @@ import { createAuth } from "@inkeep/agents-core/auth";
  * 3. Database API key
  * 4. Internal service token
  */
-declare const manageApiKeyAuth: () => hono4.MiddlewareHandler<{
+declare const manageApiKeyAuth: () => hono1.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     userId?: string;

package/dist/middleware/manageAuth.js

@@ -1,6 +1,6 @@
 import { env } from "../env.js";
 import runDbClient_default from "../data/db/runDbClient.js";
-import { getLogger, isInternalServiceToken, validateAndGetApiKey, verifyInternalServiceAuthHeader } from "@inkeep/agents-core";
+import { getLogger, isInternalServiceToken, isSlackUserToken, validateAndGetApiKey, verifyInternalServiceAuthHeader, verifySlackUserToken } from "@inkeep/agents-core";
 import { createMiddleware } from "hono/factory";
 import { HTTPException } from "hono/http-exception";
 
@@ -58,6 +58,21 @@ const manageApiKeyAuth = () => createMiddleware(async (c, next) => {
 		await next();
 		return;
 	}
+	if (isSlackUserToken(token)) {
+		const result = await verifySlackUserToken(token);
+		if (!result.valid || !result.payload) throw new HTTPException(401, { message: result.error || "Invalid Slack user token" });
+		logger.info({
+			inkeepUserId: result.payload.sub,
+			tenantId: result.payload.tenantId,
+			slackTeamId: result.payload.slack.teamId,
+			slackUserId: result.payload.slack.userId
+		}, "Slack user JWT authenticated successfully");
+		c.set("userId", result.payload.sub);
+		if (result.payload.slack.email) c.set("userEmail", result.payload.slack.email);
+		c.set("tenantId", result.payload.tenantId);
+		await next();
+		return;
+	}
 	if (isInternalServiceToken(token)) {
 		const result = await verifyInternalServiceAuthHeader(authHeader);
 		if (!result.valid || !result.payload) throw new HTTPException(401, { message: result.error || "Invalid internal service token" });

package/dist/middleware/projectAccess.d.ts

@@ -1,6 +1,6 @@
 import { ManageAppVariables } from "../types/app.js";
 import { ProjectPermissionLevel } from "@inkeep/agents-core";
-import * as hono18 from "hono";
+import * as hono2 from "hono";
 
 //#region src/middleware/projectAccess.d.ts
 /**
@@ -10,6 +10,6 @@ declare const requireProjectPermission: <Env$1 extends {
   Variables: ManageAppVariables;
 } = {
   Variables: ManageAppVariables;
-}>(permission?: ProjectPermissionLevel) => hono18.MiddlewareHandler<Env$1, string, {}, Response>;
+}>(permission?: ProjectPermissionLevel) => hono2.MiddlewareHandler<Env$1, string, {}, Response>;
 //#endregion
 export { requireProjectPermission };

package/dist/middleware/projectConfig.d.ts

@@ -1,11 +1,11 @@
 import { BaseExecutionContext, ResolvedRef } from "@inkeep/agents-core";
-import * as hono0 from "hono";
+import * as hono3 from "hono";
 
 //#region src/middleware/projectConfig.d.ts
 /**
  * Middleware that fetches the full project definition from the Management API
  */
-declare const projectConfigMiddleware: hono0.MiddlewareHandler<{
+declare const projectConfigMiddleware: hono3.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     resolvedRef: ResolvedRef;
@@ -15,7 +15,7 @@ declare const projectConfigMiddleware: hono0.MiddlewareHandler<{
  * Creates a middleware that applies project config fetching except for specified route patterns
  * @param skipRouteCheck - Function that returns true if the route should skip the middleware
  */
-declare const projectConfigMiddlewareExcept: (skipRouteCheck: (path: string) => boolean) => hono0.MiddlewareHandler<{
+declare const projectConfigMiddlewareExcept: (skipRouteCheck: (path: string) => boolean) => hono3.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     resolvedRef: ResolvedRef;

package/dist/middleware/requirePermission.d.ts

@@ -1,5 +1,5 @@
 import { ManageAppVariables } from "../types/app.js";
-import * as hono9 from "hono";
+import * as hono5 from "hono";
 
 //#region src/middleware/requirePermission.d.ts
 type Permission = {
@@ -9,6 +9,6 @@ declare const requirePermission: <Env$1 extends {
   Variables: ManageAppVariables;
 } = {
   Variables: ManageAppVariables;
-}>(permissions: Permission) => hono9.MiddlewareHandler<Env$1, string, {}, Response>;
+}>(permissions: Permission) => hono5.MiddlewareHandler<Env$1, string, {}, Response>;
 //#endregion
 export { requirePermission };

package/dist/middleware/runAuth.d.ts

@@ -1,8 +1,8 @@
 import { BaseExecutionContext } from "@inkeep/agents-core";
-import * as hono12 from "hono";
+import * as hono6 from "hono";
 
 //#region src/middleware/runAuth.d.ts
-declare const runApiKeyAuth: () => hono12.MiddlewareHandler<{
+declare const runApiKeyAuth: () => hono6.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };
@@ -11,7 +11,7 @@ declare const runApiKeyAuth: () => hono12.MiddlewareHandler<{
  * Creates a middleware that applies API key authentication except for specified route patterns
  * @param skipRouteCheck - Function that returns true if the route should skip authentication
  */
-declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) => hono12.MiddlewareHandler<{
+declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) => hono6.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };
@@ -20,7 +20,7 @@ declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) =
  * Helper middleware for endpoints that optionally support API key authentication
  * If no auth header is present, it continues without setting the executionContext
  */
-declare const runOptionalAuth: () => hono12.MiddlewareHandler<{
+declare const runOptionalAuth: () => hono6.MiddlewareHandler<{
   Variables: {
     executionContext?: BaseExecutionContext;
   };

package/dist/middleware/runAuth.js

@@ -2,7 +2,7 @@ import { getLogger as getLogger$1 } from "../logger.js";
 import { env } from "../env.js";
 import runDbClient_default from "../data/db/runDbClient.js";
 import { createBaseExecutionContext } from "../types/runExecutionContext.js";
-import { canUseProjectStrict, validateAndGetApiKey, validateTargetAgent, verifyServiceToken, verifyTempToken } from "@inkeep/agents-core";
+import { canUseProjectStrict, isSlackUserToken, validateAndGetApiKey, validateTargetAgent, verifyServiceToken, verifySlackUserToken, verifyTempToken } from "@inkeep/agents-core";
 import { createMiddleware } from "hono/factory";
 import { HTTPException } from "hono/http-exception";
 
@@ -125,6 +125,73 @@ async function tryApiKeyAuth(apiKey) {
 	};
 }
 /**
+* Authenticate using a Slack user JWT token (for Slack work app delegation)
+*/
+async function trySlackUserJwtAuth(token, reqData) {
+	if (!isSlackUserToken(token)) return { authResult: null };
+	const result = await verifySlackUserToken(token);
+	if (!result.valid || !result.payload) {
+		logger.warn({ error: result.error }, "Invalid Slack user JWT token");
+		return {
+			authResult: null,
+			failureMessage: `Invalid Slack user token: ${result.error || "Invalid token"}`
+		};
+	}
+	const payload = result.payload;
+	if (!reqData.projectId || !reqData.agentId) {
+		logger.warn({
+			hasProjectId: !!reqData.projectId,
+			hasAgentId: !!reqData.agentId
+		}, "Slack user JWT requires x-inkeep-project-id and x-inkeep-agent-id headers");
+		return {
+			authResult: null,
+			failureMessage: "Slack user token requires x-inkeep-project-id and x-inkeep-agent-id headers"
+		};
+	}
+	try {
+		if (!await canUseProjectStrict({
+			userId: payload.sub,
+			projectId: reqData.projectId
+		})) {
+			logger.warn({
+				userId: payload.sub,
+				tenantId: payload.tenantId,
+				projectId: reqData.projectId
+			}, "Slack user JWT: user does not have access to requested project");
+			return {
+				authResult: null,
+				failureMessage: "Access denied: insufficient permissions for the requested project"
+			};
+		}
+	} catch (error) {
+		logger.error({
+			error,
+			userId: payload.sub,
+			projectId: reqData.projectId
+		}, "SpiceDB permission check failed for Slack JWT");
+		throw new HTTPException(503, { message: "Authorization service temporarily unavailable" });
+	}
+	logger.info({
+		inkeepUserId: payload.sub,
+		tenantId: payload.tenantId,
+		slackTeamId: payload.slack.teamId,
+		slackUserId: payload.slack.userId,
+		projectId: reqData.projectId,
+		agentId: reqData.agentId
+	}, "Slack user JWT token authenticated successfully");
+	return { authResult: {
+		apiKey: "slack-user-jwt",
+		tenantId: payload.tenantId,
+		projectId: reqData.projectId,
+		agentId: reqData.agentId,
+		apiKeyId: "slack-user-token",
+		metadata: { initiatedBy: {
+			type: "user",
+			id: payload.sub
+		} }
+	} };
+}
+/**
 * Authenticate using a team agent JWT token (for intra-tenant delegation)
 */
 async function tryTeamAgentAuth(token, expectedSubAgentId) {
@@ -210,6 +277,9 @@ async function authenticateRequest(reqData) {
 	if (jwtResult) return { authResult: jwtResult };
 	const bypassResult = tryBypassAuth(apiKey, reqData);
 	if (bypassResult) return { authResult: bypassResult };
+	const slackAttempt = await trySlackUserJwtAuth(apiKey, reqData);
+	if (slackAttempt.authResult) return { authResult: slackAttempt.authResult };
+	if (slackAttempt.failureMessage) return slackAttempt;
 	const apiKeyResult = await tryApiKeyAuth(apiKey);
 	if (apiKeyResult) return { authResult: apiKeyResult };
 	const teamAttempt = await tryTeamAgentAuth(apiKey, subAgentId);

package/dist/middleware/sessionAuth.d.ts

@@ -1,4 +1,4 @@
-import * as hono7 from "hono";
+import * as hono9 from "hono";
 
 //#region src/middleware/sessionAuth.d.ts
 
@@ -7,11 +7,11 @@ import * as hono7 from "hono";
  * Requires that a user has already been authenticated via Better Auth session.
  * Used primarily for manage routes that require an active user session.
  */
-declare const sessionAuth: () => hono7.MiddlewareHandler<any, string, {}, Response>;
+declare const sessionAuth: () => hono9.MiddlewareHandler<any, string, {}, Response>;
 /**
  * Global session middleware - sets user and session in context for all routes
  * Used for all routes that require an active user session.
  */
-declare const sessionContext: () => hono7.MiddlewareHandler<any, string, {}, Response>;
+declare const sessionContext: () => hono9.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { sessionAuth, sessionContext };

package/dist/middleware/tenantAccess.d.ts

@@ -1,4 +1,4 @@
-import * as hono15 from "hono";
+import * as hono11 from "hono";
 
 //#region src/middleware/tenantAccess.d.ts
 
@@ -11,7 +11,7 @@ import * as hono15 from "hono";
  * - API key user: Access only to the tenant associated with the API key
  * - Session user: Access based on organization membership
  */
-declare const requireTenantAccess: () => hono15.MiddlewareHandler<{
+declare const requireTenantAccess: () => hono11.MiddlewareHandler<{
   Variables: {
     userId: string;
     tenantId: string;

package/dist/middleware/tracing.d.ts

@@ -1,7 +1,7 @@
-import * as hono10 from "hono";
+import * as hono12 from "hono";
 
 //#region src/middleware/tracing.d.ts
-declare const otelBaggageMiddleware: () => hono10.MiddlewareHandler<any, string, {}, Response>;
-declare const executionBaggageMiddleware: () => hono10.MiddlewareHandler<any, string, {}, Response>;
+declare const otelBaggageMiddleware: () => hono12.MiddlewareHandler<any, string, {}, Response>;
+declare const executionBaggageMiddleware: () => hono12.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { executionBaggageMiddleware, otelBaggageMiddleware };

package/dist/middleware/workAppsAuth.d.ts

@@ -0,0 +1,7 @@
+import { Context, Next } from "hono";
+
+//#region src/middleware/workAppsAuth.d.ts
+
+declare const workAppsAuth: (c: Context, next: Next) => Promise<void | Response>;
+//#endregion
+export { workAppsAuth };

package/dist/middleware/workAppsAuth.js

@@ -0,0 +1,30 @@
+import { env } from "../env.js";
+import { sessionAuth } from "./sessionAuth.js";
+import { manageApiKeyAuth } from "./manageAuth.js";
+
+//#region src/middleware/workAppsAuth.ts
+const isTestEnvironment = () => env.ENVIRONMENT === "test";
+const workAppsAuth = async (c, next) => {
+	if (isTestEnvironment()) {
+		await next();
+		return;
+	}
+	if (env.ENVIRONMENT === "development") {
+		const origin = c.req.header("Origin");
+		if (origin) try {
+			const originUrl = new URL(origin);
+			if (originUrl.hostname === "localhost" || originUrl.hostname === "127.0.0.1") {
+				c.set("userId", "dev-user");
+				c.set("tenantId", "default");
+				c.set("tenantRole", "owner");
+				await next();
+				return;
+			}
+		} catch {}
+	}
+	if (c.req.header("Authorization")?.startsWith("Bearer ")) return manageApiKeyAuth()(c, next);
+	return sessionAuth()(c, next);
+};
+
+//#endregion
+export { workAppsAuth };

package/dist/openapi.d.ts

@@ -8,6 +8,7 @@ declare const TagToDescription: {
   Agents: string;
   'Artifact Components': string;
   Branches: string;
+  Channels: string;
   CLI: string;
   Chat: string;
   'Context Configs': string;
@@ -27,13 +28,17 @@ declare const TagToDescription: {
   'Project Permissions': string;
   Projects: string;
   Refs: string;
+  Slack: string;
   SubAgents: string;
   'Third-Party MCP Servers': string;
   Tools: string;
   Triggers: string;
   'User Project Memberships': string;
+  Users: string;
   Webhooks: string;
+  'Work Apps': string;
   Workflows: string;
+  Workspaces: string;
 };
 declare function setupOpenAPIRoutes<E extends Env = Env>(app: OpenAPIHono<E>): void;
 //#endregion

package/dist/openapi.js

@@ -7,6 +7,7 @@ const TagToDescription = {
 	Agents: "Operations for managing agents",
 	"Artifact Components": "Operations for managing artifact components",
 	Branches: "Operations for managing branches",
+	Channels: "Operations for managing Slack channels",
 	CLI: "CLI authentication endpoints",
 	Chat: "Chat completions endpoints",
 	"Context Configs": "Operations for managing context configurations",
@@ -26,13 +27,17 @@ const TagToDescription = {
 	"Project Permissions": "Operations for managing project permissions",
 	Projects: "Operations for managing projects",
 	Refs: "Operations for the resolved ref (branch name, tag name, or commit hash)",
+	Slack: "Slack App integration endpoints",
 	SubAgents: "Operations for managing sub agents",
 	"Third-Party MCP Servers": "Operations for managing third-party MCP servers",
 	Tools: "Operations for managing MCP tools",
 	Triggers: "Operations for managing triggers",
 	"User Project Memberships": "Operations for managing user project memberships",
+	Users: "Operations for managing users",
 	Webhooks: "Webhook endpoints",
-	Workflows: "Workflow trigger endpoints"
+	"Work Apps": "Work app integrations (Slack, Teams, etc.)",
+	Workflows: "Workflow trigger endpoints",
+	Workspaces: "Operations for managing Slack workspaces"
 };
 function setupOpenAPIRoutes(app) {
 	app.get("/openapi.json", (c) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkeep/agents-api",
-  "version": "0.0.0-dev-20260211191741",
+  "version": "0.0.0-dev-20260211220939",
   "description": "Unified Inkeep Agents API - combines management, runtime, and evaluation capabilities",
   "types": "dist/index.d.ts",
   "exports": {
@@ -66,10 +66,10 @@
     "openid-client": "^6.8.1",
     "pg": "^8.16.3",
     "workflow": "4.0.1-beta.33",
-    "@inkeep/agents-core": "^0.0.0-dev-20260211191741",
-    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20260211191741",
-    "@inkeep/agents-mcp": "^0.0.0-dev-20260211191741",
-    "@inkeep/agents-work-apps": "^0.0.0-dev-20260211191741"
+    "@inkeep/agents-core": "^0.0.0-dev-20260211220939",
+    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20260211220939",
+    "@inkeep/agents-mcp": "^0.0.0-dev-20260211220939",
+    "@inkeep/agents-work-apps": "^0.0.0-dev-20260211220939"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^1.1.5",