@inkeep/agents-api 0.0.0-dev-20260219033751 → 0.0.0-dev-20260219045007

package/dist/middleware/ref.js

@@ -214,26 +214,6 @@ const runRefMiddleware = createRefMiddleware(manageDbClient_default, {
 	extractProjectId: extractProjectIdFromExecutionContext,
 	allowProjectIdFromBody: false
 });
-/**
-* Extract tenantId from query parameters (for OAuth routes)
-*/
-const extractTenantIdFromQuery = (c) => {
-	return c.req.query("tenantId");
-};
-/**
-* Extract projectId from query parameters (for OAuth routes)
-*/
-const extractProjectIdFromQuery = (c) => {
-	return c.req.query("projectId");
-};
-/**
-* Ref middleware for OAuth routes - extracts tenant/project from query params
-*/
-const oauthRefMiddleware = createRefMiddleware(manageDbClient_default, {
-	extractTenantId: extractTenantIdFromQuery,
-	extractProjectId: extractProjectIdFromQuery,
-	allowProjectIdFromBody: false
-});
 
 //#endregion
-export { createRefMiddleware, manageRefMiddleware, oauthRefMiddleware, runRefMiddleware, writeProtectionMiddleware };
+export { createRefMiddleware, manageRefMiddleware, runRefMiddleware, writeProtectionMiddleware };

package/dist/middleware/requirePermission.d.ts

@@ -1,5 +1,5 @@
 import { ManageAppVariables } from "../types/app.js";
-import * as hono12 from "hono";
+import * as hono11 from "hono";
 
 //#region src/middleware/requirePermission.d.ts
 type Permission = {
@@ -9,6 +9,6 @@ declare const requirePermission: <Env$1 extends {
   Variables: ManageAppVariables;
 } = {
   Variables: ManageAppVariables;
-}>(permissions: Permission) => hono12.MiddlewareHandler<Env$1, string, {}, Response>;
+}>(permissions: Permission) => hono11.MiddlewareHandler<Env$1, string, {}, Response>;
 //#endregion
 export { requirePermission };

package/dist/middleware/requirePermission.js

@@ -1,79 +1,79 @@
 import { createApiError } from "@inkeep/agents-core";
+import { registerAuthzMeta } from "@inkeep/agents-core/middleware";
 import { createMiddleware } from "hono/factory";
 import { HTTPException } from "hono/http-exception";
 
 //#region src/middleware/requirePermission.ts
-function formatPermissionsForDisplay(permissions) {
-	const formatted = [];
-	for (const [resource, actions] of Object.entries(permissions)) {
-		const actionList = Array.isArray(actions) ? actions : [actions];
-		for (const action of actionList) formatted.push(`${resource}:${action}`);
-	}
-	return formatted;
-}
-const requirePermission = (permissions) => createMiddleware(async (c, next) => {
-	const isTestEnvironment = process.env.ENVIRONMENT === "test";
-	const auth = c.get("auth");
-	if (isTestEnvironment || !auth) {
-		await next();
-		return;
-	}
-	const userId = c.get("userId");
-	const tenantId = c.get("tenantId");
-	const tenantRole = c.get("tenantRole");
-	const requiredPermissions = formatPermissionsForDisplay(permissions);
-	if (userId === "system" || userId?.startsWith("apikey:")) {
-		await next();
-		return;
-	}
-	if (!userId || !tenantId) throw createApiError({
-		code: "unauthorized",
-		message: "User or organization context not found. Ensure you are authenticated and belong to an organization.",
-		instance: c.req.path,
-		extensions: {
-			requiredPermissions,
-			context: {
-				hasUserId: !!userId,
-				hasTenantId: !!tenantId
-			}
+const requirePermission = (permissions) => {
+	const mw = createMiddleware(async (c, next) => {
+		const isTestEnvironment = process.env.ENVIRONMENT === "test";
+		const auth = c.get("auth");
+		if (isTestEnvironment || !auth) {
+			await next();
+			return;
 		}
-	});
-	try {
-		const result = await auth.api.hasPermission({
-			body: {
-				permissions,
-				organizationId: tenantId
-			},
-			headers: c.req.raw.headers
-		});
-		if (!result || !result.success) throw createApiError({
-			code: "forbidden",
-			message: `Permission denied. Required: ${requiredPermissions.join(", ")}`,
+		const userId = c.get("userId");
+		const tenantId = c.get("tenantId");
+		const tenantRole = c.get("tenantRole");
+		if (userId === "system" || userId?.startsWith("apikey:")) {
+			await next();
+			return;
+		}
+		if (!userId || !tenantId) throw createApiError({
+			code: "unauthorized",
+			message: "User or organization context not found. Ensure you are authenticated and belong to an organization.",
 			instance: c.req.path,
 			extensions: {
-				requiredPermissions,
+				permissions,
 				context: {
-					userId,
-					organizationId: tenantId,
-					currentRole: tenantRole || "unknown"
+					hasUserId: !!userId,
+					hasTenantId: !!tenantId
 				}
 			}
 		});
-		await next();
-	} catch (error) {
-		if (error instanceof HTTPException) throw error;
-		const errorMessage = error instanceof Error ? error.message : "Unknown error";
-		throw createApiError({
-			code: "internal_server_error",
-			message: "Failed to verify permissions",
-			instance: c.req.path,
-			extensions: {
-				requiredPermissions,
-				internalError: errorMessage
-			}
-		});
-	}
-});
+		try {
+			const result = await auth.api.hasPermission({
+				body: {
+					permissions,
+					organizationId: tenantId
+				},
+				headers: c.req.raw.headers
+			});
+			if (!result || !result.success) throw createApiError({
+				code: "forbidden",
+				message: "Permission denied. Required: organization admin.",
+				instance: c.req.path,
+				extensions: {
+					permissions,
+					context: {
+						userId,
+						organizationId: tenantId,
+						currentRole: tenantRole || "unknown"
+					}
+				}
+			});
+			await next();
+		} catch (error) {
+			if (error instanceof HTTPException) throw error;
+			const errorMessage = error instanceof Error ? error.message : "Unknown error";
+			throw createApiError({
+				code: "internal_server_error",
+				message: "Failed to verify permissions",
+				instance: c.req.path,
+				extensions: {
+					permissions,
+					internalError: errorMessage
+				}
+			});
+		}
+	});
+	registerAuthzMeta(mw, {
+		resource: "organization",
+		permission: "admin",
+		description: "Requires organization admin role"
+	});
+	return mw;
+};
 
 //#endregion
 export { requirePermission };

package/dist/middleware/runAuth.d.ts

@@ -1,8 +1,8 @@
 import { BaseExecutionContext } from "@inkeep/agents-core";
-import * as hono0 from "hono";
+import * as hono3 from "hono";
 
 //#region src/middleware/runAuth.d.ts
-declare const runApiKeyAuth: () => hono0.MiddlewareHandler<{
+declare const runApiKeyAuth: () => hono3.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };
@@ -11,7 +11,7 @@ declare const runApiKeyAuth: () => hono0.MiddlewareHandler<{
  * Creates a middleware that applies API key authentication except for specified route patterns
  * @param skipRouteCheck - Function that returns true if the route should skip authentication
  */
-declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) => hono0.MiddlewareHandler<{
+declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) => hono3.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };
@@ -20,7 +20,7 @@ declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) =
  * Helper middleware for endpoints that optionally support API key authentication
  * If no auth header is present, it continues without setting the executionContext
  */
-declare const runOptionalAuth: () => hono0.MiddlewareHandler<{
+declare const runOptionalAuth: () => hono3.MiddlewareHandler<{
   Variables: {
     executionContext?: BaseExecutionContext;
   };

package/dist/middleware/sessionAuth.d.ts

@@ -1,4 +1,4 @@
-import * as hono13 from "hono";
+import * as hono12 from "hono";
 
 //#region src/middleware/sessionAuth.d.ts
 
@@ -7,11 +7,11 @@ import * as hono13 from "hono";
  * Requires that a user has already been authenticated via Better Auth session.
  * Used primarily for manage routes that require an active user session.
  */
-declare const sessionAuth: () => hono13.MiddlewareHandler<any, string, {}, Response>;
+declare const sessionAuth: () => hono12.MiddlewareHandler<any, string, {}, Response>;
 /**
  * Global session middleware - sets user and session in context for all routes
  * Used for all routes that require an active user session.
  */
-declare const sessionContext: () => hono13.MiddlewareHandler<any, string, {}, Response>;
+declare const sessionContext: () => hono12.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { sessionAuth, sessionContext };

package/dist/middleware/sessionAuth.js

@@ -1,4 +1,5 @@
 import { createApiError } from "@inkeep/agents-core";
+import { registerAuthzMeta } from "@inkeep/agents-core/middleware";
 import { createMiddleware } from "hono/factory";
 import { HTTPException } from "hono/http-exception";
 
@@ -8,24 +9,28 @@ import { HTTPException } from "hono/http-exception";
 * Requires that a user has already been authenticated via Better Auth session.
 * Used primarily for manage routes that require an active user session.
 */
-const sessionAuth = () => createMiddleware(async (c, next) => {
-	try {
-		const user = c.get("user");
-		if (!user) throw createApiError({
-			code: "unauthorized",
-			message: "Please log in to access this resource"
-		});
-		c.set("userId", user.id);
-		c.set("userEmail", user.email);
-		await next();
-	} catch (error) {
-		if (error instanceof HTTPException) throw error;
-		throw createApiError({
-			code: "unauthorized",
-			message: "Authentication failed"
-		});
-	}
-});
+const sessionAuth = () => {
+	const mw = createMiddleware(async (c, next) => {
+		try {
+			const user = c.get("user");
+			if (!user) throw createApiError({
+				code: "unauthorized",
+				message: "Please log in to access this resource"
+			});
+			c.set("userId", user.id);
+			c.set("userEmail", user.email);
+			await next();
+		} catch (error) {
+			if (error instanceof HTTPException) throw error;
+			throw createApiError({
+				code: "unauthorized",
+				message: "Authentication failed"
+			});
+		}
+	});
+	registerAuthzMeta(mw, { description: "Requires an active user session (cookie-based)" });
+	return mw;
+};
 /**
 * Global session middleware - sets user and session in context for all routes
 * Used for all routes that require an active user session.

package/dist/middleware/tenantAccess.d.ts

@@ -1,4 +1,4 @@
-import * as hono17 from "hono";
+import * as hono6 from "hono";
 
 //#region src/middleware/tenantAccess.d.ts
 
@@ -7,11 +7,12 @@ import * as hono17 from "hono";
  * Verifies that the authenticated user has access to the requested tenant/organization.
  *
  * Access rules:
+ * - Test environment: Grants anonymous owner access (bypasses all checks)
  * - System user (bypass auth): Full access to all tenants
  * - API key user: Access only to the tenant associated with the API key
  * - Session user: Access based on organization membership
  */
-declare const requireTenantAccess: () => hono17.MiddlewareHandler<{
+declare const requireTenantAccess: () => hono6.MiddlewareHandler<{
   Variables: {
     userId: string;
     tenantId: string;

package/dist/middleware/tenantAccess.js

@@ -1,3 +1,4 @@
+import { env } from "../env.js";
 import runDbClient_default from "../data/db/runDbClient.js";
 import { OrgRoles, createApiError, getUserOrganizationsFromDb } from "@inkeep/agents-core";
 import { createMiddleware } from "hono/factory";
@@ -9,13 +10,23 @@ import { HTTPException } from "hono/http-exception";
 * Verifies that the authenticated user has access to the requested tenant/organization.
 *
 * Access rules:
+* - Test environment: Grants anonymous owner access (bypasses all checks)
 * - System user (bypass auth): Full access to all tenants
 * - API key user: Access only to the tenant associated with the API key
 * - Session user: Access based on organization membership
 */
 const requireTenantAccess = () => createMiddleware(async (c, next) => {
-	const userId = c.get("userId");
 	const tenantId = c.req.param("tenantId");
+	if (env.ENVIRONMENT === "test") {
+		if (tenantId) {
+			c.set("tenantId", tenantId);
+			c.set("userId", "anonymous");
+			c.set("tenantRole", OrgRoles.OWNER);
+		}
+		await next();
+		return;
+	}
+	const userId = c.get("userId");
 	if (!userId) throw createApiError({
 		code: "unauthorized",
 		message: "User ID not found"

package/dist/middleware/tracing.d.ts

@@ -1,7 +1,7 @@
-import * as hono9 from "hono";
+import * as hono7 from "hono";
 
 //#region src/middleware/tracing.d.ts
-declare const otelBaggageMiddleware: () => hono9.MiddlewareHandler<any, string, {}, Response>;
-declare const executionBaggageMiddleware: () => hono9.MiddlewareHandler<any, string, {}, Response>;
+declare const otelBaggageMiddleware: () => hono7.MiddlewareHandler<any, string, {}, Response>;
+declare const executionBaggageMiddleware: () => hono7.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { executionBaggageMiddleware, otelBaggageMiddleware };

package/dist/middleware/tracing.js

@@ -1,6 +1,6 @@
 import { getLogger } from "../logger.js";
-import { context, propagation } from "@opentelemetry/api";
 import { createMiddleware } from "hono/factory";
+import { context, propagation } from "@opentelemetry/api";
 
 //#region src/middleware/tracing.ts
 const logger = getLogger("tracing-middleware");

package/dist/routes/capabilities.d.ts

@@ -0,0 +1,10 @@
+import { AppVariables } from "../types/app.js";
+import "../types/index.js";
+import { OpenAPIHono } from "@hono/zod-openapi";
+
+//#region src/routes/capabilities.d.ts
+declare const capabilitiesHandler: OpenAPIHono<{
+  Variables: AppVariables;
+}, {}, "/">;
+//#endregion
+export { capabilitiesHandler };

package/dist/routes/capabilities.js

@@ -0,0 +1,35 @@
+import { manageApiKeyOrSessionAuth } from "../middleware/manageAuth.js";
+import "../middleware/index.js";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
+import { createProtectedRoute } from "@inkeep/agents-core/middleware";
+
+//#region src/routes/capabilities.ts
+const capabilitiesHandler = new OpenAPIHono();
+const CapabilitiesResponseSchema = z.object({ sandbox: z.object({
+	configured: z.boolean().describe("Whether a sandbox provider is configured. Required for Function Tools execution."),
+	provider: z.enum(["native", "vercel"]).optional().describe("The configured sandbox provider, if enabled."),
+	runtime: z.enum(["node22", "typescript"]).optional().describe("The configured sandbox runtime, if enabled.")
+}).describe("Sandbox execution capabilities (used by Function Tools).") }).describe("Optional server capabilities and configuration.").openapi("CapabilitiesResponseSchema");
+capabilitiesHandler.openapi(createProtectedRoute({
+	method: "get",
+	path: "/",
+	operationId: "capabilities",
+	summary: "Get server capabilities",
+	description: "Get information about optional server-side capabilities and configuration.",
+	permission: manageApiKeyOrSessionAuth(),
+	responses: { 200: {
+		description: "Server capabilities",
+		content: { "application/json": { schema: CapabilitiesResponseSchema } }
+	} }
+}), (c) => {
+	const sandboxConfig = c.get("sandboxConfig");
+	if (!sandboxConfig) return c.json({ sandbox: { configured: false } });
+	return c.json({ sandbox: {
+		configured: true,
+		provider: sandboxConfig.provider,
+		runtime: sandboxConfig.runtime
+	} });
+});
+
+//#endregion
+export { capabilitiesHandler };

package/dist/routes/healthChecks.js

@@ -1,17 +1,19 @@
 import manageDbPool_default from "../data/db/manageDbPool.js";
 import runDbClient_default from "../data/db/runDbClient.js";
 import { checkManageDb, checkRunDb } from "../utils/healthChecks.js";
-import { OpenAPIHono, createRoute, z } from "@hono/zod-openapi";
+import { OpenAPIHono, z } from "@hono/zod-openapi";
+import { createProtectedRoute, noAuth } from "@inkeep/agents-core/middleware";
 
 //#region src/routes/healthChecks.ts
 const healthChecksHandler = new OpenAPIHono();
-healthChecksHandler.openapi(createRoute({
+healthChecksHandler.openapi(createProtectedRoute({
 	method: "get",
 	path: "/health",
 	operationId: "health",
 	tags: ["Health"],
 	summary: "Health check",
 	description: "Check if the management service is healthy",
+	permission: noAuth(),
 	responses: { 204: { description: "Service is healthy" } }
 }), (c) => {
 	return c.body(null, 204);
@@ -32,13 +34,14 @@ const ReadyErrorResponseSchema = z.object({
 	detail: z.string().describe("A human-readable explanation specific to this occurrence"),
 	checks: ReadyErrorChecksSchema
 }).openapi("ReadyErrorResponse");
-healthChecksHandler.openapi(createRoute({
+healthChecksHandler.openapi(createProtectedRoute({
 	method: "get",
 	path: "/ready",
 	operationId: "ready",
 	tags: ["Health"],
 	summary: "Readiness check",
 	description: "Check if the service is ready to serve traffic by verifying database connectivity",
+	permission: noAuth(),
 	responses: {
 		200: {
 			description: "Service is ready - all health checks passed",

package/dist/routes/workflowProcess.d.ts

@@ -0,0 +1,10 @@
+import { AppVariables } from "../types/app.js";
+import "../types/index.js";
+import { OpenAPIHono } from "@hono/zod-openapi";
+
+//#region src/routes/workflowProcess.d.ts
+declare const workflowProcessHandler: OpenAPIHono<{
+  Variables: AppVariables;
+}, {}, "/">;
+//#endregion
+export { workflowProcessHandler };

package/dist/routes/workflowProcess.js

@@ -0,0 +1,23 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
+import { createProtectedRoute, noAuth } from "@inkeep/agents-core/middleware";
+
+//#region src/routes/workflowProcess.ts
+const workflowProcessHandler = new OpenAPIHono();
+workflowProcessHandler.openapi(createProtectedRoute({
+	method: "get",
+	path: "/api/workflow/process",
+	tags: ["Workflows"],
+	summary: "Process workflow jobs",
+	description: "Keeps the workflow worker active to process queued jobs (called by cron)",
+	permission: noAuth(),
+	responses: { 200: { description: "Processing complete" } }
+}), async (c) => {
+	await new Promise((resolve) => setTimeout(resolve, 5e4));
+	return c.json({
+		processed: true,
+		timestamp: (/* @__PURE__ */ new Date()).toISOString()
+	});
+});
+
+//#endregion
+export { workflowProcessHandler };

package/dist/types/app.d.ts

@@ -28,7 +28,7 @@ type BaseAppVariables = {
 type AppVariables = BaseAppVariables & {
   serverConfig: ServerConfig;
   credentialStores: CredentialStoreRegistry;
-  auth: ReturnType<typeof createAuth> | null;
+  auth: ReturnType<typeof createAuth>;
   user: typeof auth.$Infer.Session.user | null;
   session: typeof auth.$Infer.Session.session | null;
   sandboxConfig?: SandboxConfig;
@@ -36,7 +36,7 @@ type AppVariables = BaseAppVariables & {
 };
 type ManageAppVariables = AppVariables & {
   db: AgentsManageDatabaseClient;
-  auth: ReturnType<typeof createAuth> | null;
+  auth: ReturnType<typeof createAuth>;
   resolvedRef: ResolvedRef;
   /** Cached by projectFull middleware to avoid duplicate DB lookup for PUT upsert */
   isProjectCreate?: boolean;
@@ -44,7 +44,7 @@ type ManageAppVariables = AppVariables & {
 type AppConfig = {
   serverConfig: ServerConfig;
   credentialStores: CredentialStoreRegistry;
-  auth: ReturnType<typeof createAuth> | null;
+  auth: ReturnType<typeof createAuth>;
   sandboxConfig?: SandboxConfig;
 };
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkeep/agents-api",
-  "version": "0.0.0-dev-20260219033751",
+  "version": "0.0.0-dev-20260219045007",
   "description": "Unified Inkeep Agents API - combines management, runtime, and evaluation capabilities",
   "types": "dist/index.d.ts",
   "exports": {
@@ -67,9 +67,9 @@
     "openid-client": "^6.8.1",
     "pg": "^8.16.3",
     "workflow": "^4.1.0-beta.54",
-    "@inkeep/agents-core": "^0.0.0-dev-20260219033751",
-    "@inkeep/agents-work-apps": "^0.0.0-dev-20260219033751",
-    "@inkeep/agents-mcp": "^0.0.0-dev-20260219033751"
+    "@inkeep/agents-core": "^0.0.0-dev-20260219045007",
+    "@inkeep/agents-mcp": "^0.0.0-dev-20260219045007",
+    "@inkeep/agents-work-apps": "^0.0.0-dev-20260219045007"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^1.1.5",