@inkeep/agents-api 0.0.1

package/dist/index.js

@@ -0,0 +1,44 @@
+import { env } from "./env.js";
+import { defaultSDK } from "./instrumentation.js";
+import { createAgentsHono } from "./createApp.js";
+import { initializeDefaultUser } from "./initialization.js";
+import { createAuth0Provider, createOIDCProvider } from "./ssoHelpers.js";
+import { createAgentsApp, createAgentsAuth } from "./factory.js";
+import { Hono } from "hono";
+import { CredentialStoreRegistry, createDefaultCredentialStores } from "@inkeep/agents-core";
+
+//#region src/index.ts
+defaultSDK.start();
+const defaultConfig = {
+	port: 3002,
+	serverOptions: {
+		requestTimeout: 12e4,
+		keepAliveTimeout: 6e4,
+		keepAlive: true
+	}
+};
+const ssoProviders = await Promise.all([process.env.AUTH0_DOMAIN && process.env.AUTH0_CLIENT_ID && process.env.AUTH0_CLIENT_SECRET ? createAuth0Provider({
+	domain: process.env.AUTH0_DOMAIN,
+	clientId: process.env.AUTH0_CLIENT_ID,
+	clientSecret: process.env.AUTH0_CLIENT_SECRET
+}) : null]);
+const socialProviders = process.env.PUBLIC_GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET ? { google: {
+	prompt: "select_account",
+	display: "popup",
+	clientId: process.env.PUBLIC_GOOGLE_CLIENT_ID,
+	clientSecret: process.env.GOOGLE_CLIENT_SECRET
+} } : void 0;
+const auth = createAgentsAuth({
+	ssoProviders: ssoProviders.filter((p) => p !== null),
+	socialProviders
+});
+const app = createAgentsHono({
+	serverConfig: defaultConfig,
+	credentialStores: new CredentialStoreRegistry(createDefaultCredentialStores()),
+	auth
+});
+if (env.ENVIRONMENT === "development") initializeDefaultUser(auth);
+var src_default = app;
+
+//#endregion
+export { Hono, auth, createAgentsApp, createAgentsHono, createAuth0Provider, createOIDCProvider, src_default as default, initializeDefaultUser };

package/dist/initialization.d.ts

@@ -0,0 +1,6 @@
+import { createAuth } from "@inkeep/agents-core/auth";
+
+//#region src/initialization.d.ts
+declare function initializeDefaultUser(authInstance?: ReturnType<typeof createAuth> | null): Promise<void>;
+//#endregion
+export { initializeDefaultUser };

package/dist/initialization.js

@@ -0,0 +1,65 @@
+import { getLogger as getLogger$1 } from "./logger.js";
+import { env } from "./env.js";
+import runDbClient_default from "./data/db/runDbClient.js";
+import { addUserToOrganization, getUserByEmail, upsertOrganization } from "@inkeep/agents-core";
+
+//#region src/initialization.ts
+const logger = getLogger$1("initialization");
+async function initializeDefaultUser(authInstance) {
+	const { INKEEP_AGENTS_MANAGE_UI_USERNAME, INKEEP_AGENTS_MANAGE_UI_PASSWORD, DISABLE_AUTH } = env;
+	const hasCredentials = INKEEP_AGENTS_MANAGE_UI_USERNAME && INKEEP_AGENTS_MANAGE_UI_PASSWORD;
+	const orgId = env.TENANT_ID;
+	const { created } = await upsertOrganization(runDbClient_default)({
+		organizationId: orgId,
+		name: env.TENANT_ID,
+		slug: env.TENANT_ID,
+		logo: null,
+		metadata: null
+	});
+	if (created) logger.info({ organizationId: orgId }, "Created default organization");
+	else logger.info({ organizationId: orgId }, "Organization already exists");
+	if (!hasCredentials || DISABLE_AUTH || !authInstance) {
+		logger.info({ hasCredentials: false }, "Skipping default user creation");
+		return;
+	}
+	try {
+		let user = await getUserByEmail(runDbClient_default)(INKEEP_AGENTS_MANAGE_UI_USERNAME);
+		if (user) logger.info({
+			email: INKEEP_AGENTS_MANAGE_UI_USERNAME,
+			userId: user.id
+		}, "Default user already exists");
+		else {
+			logger.info({ email: INKEEP_AGENTS_MANAGE_UI_USERNAME }, "Creating default user with Better Auth...");
+			if (!(await authInstance.api.signUpEmail({ body: {
+				email: INKEEP_AGENTS_MANAGE_UI_USERNAME,
+				password: INKEEP_AGENTS_MANAGE_UI_PASSWORD,
+				name: INKEEP_AGENTS_MANAGE_UI_USERNAME.split("@")[0]
+			} })).user) throw new Error("signUpEmail returned no user");
+			user = await getUserByEmail(runDbClient_default)(INKEEP_AGENTS_MANAGE_UI_USERNAME);
+			if (!user) throw new Error("User was created but could not be retrieved from database");
+			logger.info({
+				email: user.email,
+				id: user.id
+			}, "Default user created from INKEEP_AGENTS_MANAGE_UI_USERNAME/INKEEP_AGENTS_MANAGE_UI_PASSWORD");
+		}
+		await addUserToOrganization(runDbClient_default)({
+			userId: user.id,
+			organizationId: orgId,
+			role: "owner"
+		});
+		logger.info({
+			organizationId: orgId,
+			organizationSlug: env.TENANT_ID,
+			userId: user.id,
+			email: INKEEP_AGENTS_MANAGE_UI_USERNAME
+		}, "Initialization complete - login with these credentials");
+	} catch (error) {
+		logger.error({
+			error,
+			email: INKEEP_AGENTS_MANAGE_UI_USERNAME
+		}, "Failed to create default user");
+	}
+}
+
+//#endregion
+export { initializeDefaultUser };

package/dist/instrumentation.d.ts

@@ -0,0 +1,17 @@
+import { AsyncLocalStorageContextManager } from "@opentelemetry/context-async-hooks";
+import { CompositePropagator } from "@opentelemetry/core";
+import * as _opentelemetry_resources0 from "@opentelemetry/resources";
+import { NodeSDK, NodeSDKConfiguration } from "@opentelemetry/sdk-node";
+import { SpanProcessor } from "@opentelemetry/sdk-trace-base";
+
+//#region src/instrumentation.d.ts
+declare const defaultBatchProcessor: SpanProcessor;
+declare const defaultResource: _opentelemetry_resources0.Resource;
+declare const defaultInstrumentations: NonNullable<NodeSDKConfiguration['instrumentations']>;
+declare const defaultSpanProcessors: SpanProcessor[];
+declare const defaultContextManager: AsyncLocalStorageContextManager;
+declare const defaultTextMapPropagator: CompositePropagator;
+declare const defaultSDK: NodeSDK;
+declare function flushBatchProcessor(): Promise<void>;
+//#endregion
+export { defaultBatchProcessor, defaultContextManager, defaultInstrumentations, defaultResource, defaultSDK, defaultSpanProcessors, defaultTextMapPropagator, flushBatchProcessor };

package/dist/instrumentation.js

@@ -0,0 +1,68 @@
+import { getLogger } from "./logger.js";
+import { env } from "./env.js";
+import { getNodeAutoInstrumentations } from "@opentelemetry/auto-instrumentations-node";
+import { ALLOW_ALL_BAGGAGE_KEYS, BaggageSpanProcessor } from "@opentelemetry/baggage-span-processor";
+import { AsyncLocalStorageContextManager } from "@opentelemetry/context-async-hooks";
+import { CompositePropagator, W3CBaggagePropagator, W3CTraceContextPropagator } from "@opentelemetry/core";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+import { resourceFromAttributes } from "@opentelemetry/resources";
+import { NodeSDK } from "@opentelemetry/sdk-node";
+import { BatchSpanProcessor, NoopSpanProcessor } from "@opentelemetry/sdk-trace-base";
+import { ATTR_SERVICE_NAME } from "@opentelemetry/semantic-conventions";
+
+//#region src/instrumentation.ts
+const otlpExporter = new OTLPTraceExporter();
+const logger = getLogger("instrumentation");
+/**
+* Creates a safe batch processor that falls back to no-op when SignOz is not configured
+*/
+function createSafeBatchProcessor() {
+	try {
+		return new BatchSpanProcessor(otlpExporter, {
+			scheduledDelayMillis: env.OTEL_BSP_SCHEDULE_DELAY,
+			maxExportBatchSize: env.OTEL_BSP_MAX_EXPORT_BATCH_SIZE
+		});
+	} catch (error) {
+		logger.warn({ error }, "Failed to create batch processor");
+		return new NoopSpanProcessor();
+	}
+}
+const defaultBatchProcessor = createSafeBatchProcessor();
+const defaultResource = resourceFromAttributes({ [ATTR_SERVICE_NAME]: "inkeep-agents-run-api" });
+const defaultInstrumentations = [getNodeAutoInstrumentations({
+	"@opentelemetry/instrumentation-http": {
+		enabled: true,
+		requestHook: (span, request) => {
+			const url = request?.url ?? request?.path;
+			if (!url) return;
+			const u = new URL(url, "http://localhost");
+			span.updateName(`${request?.method || "UNKNOWN"} ${u.pathname}`);
+		}
+	},
+	"@opentelemetry/instrumentation-undici": { requestHook: (span) => {
+		const method = span.attributes?.["http.request.method"];
+		const host = span.attributes?.["server.address"];
+		const path = span.attributes?.["url.path"];
+		if (method && path) span.updateName(host ? `${method} ${host}${path}` : `${method} ${path}`);
+	} }
+})];
+const defaultSpanProcessors = [new BaggageSpanProcessor(ALLOW_ALL_BAGGAGE_KEYS), defaultBatchProcessor];
+const defaultContextManager = new AsyncLocalStorageContextManager();
+const defaultTextMapPropagator = new CompositePropagator({ propagators: [new W3CTraceContextPropagator(), new W3CBaggagePropagator()] });
+const defaultSDK = new NodeSDK({
+	resource: defaultResource,
+	contextManager: defaultContextManager,
+	textMapPropagator: defaultTextMapPropagator,
+	spanProcessors: defaultSpanProcessors,
+	instrumentations: defaultInstrumentations
+});
+async function flushBatchProcessor() {
+	try {
+		await defaultBatchProcessor.forceFlush();
+	} catch (error) {
+		logger.warn({ error }, "Failed to flush batch processor");
+	}
+}
+
+//#endregion
+export { defaultBatchProcessor, defaultContextManager, defaultInstrumentations, defaultResource, defaultSDK, defaultSpanProcessors, defaultTextMapPropagator, flushBatchProcessor };

package/dist/logger.d.ts

@@ -0,0 +1,2 @@
+import { getLogger } from "@inkeep/agents-core";
+export { getLogger };

package/dist/logger.js

@@ -0,0 +1,3 @@
+import { getLogger } from "@inkeep/agents-core";
+
+export { getLogger };

package/dist/middleware/branchScopedDb.d.ts

@@ -0,0 +1,31 @@
+import { Context, Next } from "hono";
+import { AgentsManageDatabaseClient } from "@inkeep/agents-core";
+import { Pool } from "pg";
+
+//#region src/middleware/branchScopedDb.d.ts
+declare function isProjectDeleteOperation(path: string, method: string): boolean;
+/**
+ * Get the underlying connection pool from a Drizzle database client
+ */
+declare function getPoolFromClient(client: AgentsManageDatabaseClient): Pool | null;
+/**
+ * Middleware that provides branch-scoped database connections
+ *
+ * Flow:
+ * 1. Get a dedicated connection from the pool
+ * 2. If ref is specified, checkout that branch/tag/commit on this connection
+ * 3. Create a Drizzle client wrapping this specific connection
+ * 4. Inject into context as 'db' (request-scoped database client)
+ * 5. Execute the route handler
+ * 6. For write operations on branches: auto-commit changes
+ * 7. Always cleanup: checkout main and release connection
+ *
+ * This ensures:
+ * - All operations in a request use the same connection (correct)
+ * - Only one checkout per request (performant)
+ * - Automatic commits for successful writes on branches
+ * - Proper connection cleanup
+ */
+declare const branchScopedDbMiddleware: (c: Context, next: Next) => Promise<void>;
+//#endregion
+export { branchScopedDbMiddleware, getPoolFromClient, isProjectDeleteOperation };

package/dist/middleware/branchScopedDb.js

@@ -0,0 +1,137 @@
+import { getLogger as getLogger$1 } from "../logger.js";
+import manageDbClient_default from "../data/db/manageDbClient.js";
+import { checkoutBranch, doltAddAndCommit, doltReset, doltStatus, generateId } from "@inkeep/agents-core";
+import * as schema from "@inkeep/agents-core/db/manage-schema";
+import { drizzle } from "drizzle-orm/node-postgres";
+
+//#region src/middleware/branchScopedDb.ts
+const logger = getLogger$1("branch-scoped-db");
+function isProjectDeleteOperation(path, method) {
+	return method.toUpperCase() === "DELETE" && /^\/tenants\/[^/]+\/(?:projects|project-full)\/[^/]+\/?$/.test(path);
+}
+/**
+* Get the underlying connection pool from a Drizzle database client
+*/
+function getPoolFromClient(client) {
+	if ("$client" in client && client.$client) return client.$client;
+	return null;
+}
+/**
+* Middleware that provides branch-scoped database connections
+*
+* Flow:
+* 1. Get a dedicated connection from the pool
+* 2. If ref is specified, checkout that branch/tag/commit on this connection
+* 3. Create a Drizzle client wrapping this specific connection
+* 4. Inject into context as 'db' (request-scoped database client)
+* 5. Execute the route handler
+* 6. For write operations on branches: auto-commit changes
+* 7. Always cleanup: checkout main and release connection
+*
+* This ensures:
+* - All operations in a request use the same connection (correct)
+* - Only one checkout per request (performant)
+* - Automatic commits for successful writes on branches
+* - Proper connection cleanup
+*/
+const branchScopedDbMiddleware = async (c, next) => {
+	const resolvedRef = c.get("resolvedRef");
+	const method = c.req.method;
+	const userId = c.get("userId");
+	const userEmail = c.get("userEmail");
+	const pool = getPoolFromClient(manageDbClient_default);
+	if (!pool) {
+		logger.error({}, "Could not get connection pool from dbClient");
+		c.set("db", manageDbClient_default);
+		await next();
+		return;
+	}
+	if (process.env.ENVIRONMENT === "test") {
+		c.set("db", manageDbClient_default);
+		await next();
+		return;
+	}
+	const connection = await pool.connect();
+	let tempBranch = null;
+	try {
+		const requestDb = drizzle(connection, { schema });
+		if (resolvedRef.type === "branch") {
+			logger.debug({ branch: resolvedRef.name }, "Checking out branch");
+			await checkoutBranch(requestDb)({
+				branchName: resolvedRef.name,
+				autoCommitPending: true
+			});
+		} else {
+			tempBranch = `temp_${resolvedRef.type}_${resolvedRef.hash}_${generateId()}`;
+			logger.debug({
+				tempBranch,
+				hash: resolvedRef.hash
+			}, "Creating temporary branch");
+			await connection.query(`SELECT DOLT_CHECKOUT('-b', $1, $2)`, [tempBranch, resolvedRef.hash]);
+		}
+		c.set("db", requestDb);
+		await next();
+		const status = c.res.status;
+		const projectDeleteOperation = isProjectDeleteOperation(c.req.path, method);
+		const operationSuccess = status >= 200 && status < 300;
+		if (resolvedRef.type === "branch" && operationSuccess && !projectDeleteOperation) try {
+			const statusResult = await doltStatus(requestDb)();
+			if (statusResult.length > 0 && operationSuccess) {
+				const path = c.req.path;
+				const commitMessage = generateCommitMessage(method, path);
+				logger.info({
+					branch: resolvedRef.name,
+					message: commitMessage
+				}, "Auto-committing changes");
+				await doltAddAndCommit(requestDb)({
+					message: commitMessage,
+					author: {
+						name: userId ?? "agents-api",
+						email: userEmail ?? "api@inkeep.com"
+					}
+				});
+				logger.info({ branch: resolvedRef.name }, "Successfully committed changes");
+			} else if (statusResult.length > 0 && !operationSuccess) {
+				await doltReset(requestDb)();
+				logger.info({ branch: resolvedRef.name }, "Successfully reset changes due to failed operation");
+			}
+		} catch (error) {
+			logger.error({
+				error,
+				branch: resolvedRef.name
+			}, "Failed to auto-commit changes");
+		}
+	} finally {
+		try {
+			await connection.query(`SELECT DOLT_CHECKOUT('main')`);
+			if (tempBranch) await connection.query(`SELECT DOLT_BRANCH('-D', $1)`, [tempBranch]);
+		} catch (cleanupError) {
+			logger.error({ error: cleanupError }, "Error during connection cleanup");
+		} finally {
+			connection.release();
+		}
+	}
+};
+/**
+* Generate a commit message based on HTTP method and path
+*/
+function generateCommitMessage(method, path) {
+	let operation;
+	switch (method) {
+		case "POST":
+			operation = "Create";
+			break;
+		case "PUT":
+		case "PATCH":
+			operation = "Update";
+			break;
+		case "DELETE":
+			operation = "Delete";
+			break;
+		default: operation = method;
+	}
+	return `${operation} ${path} via API`;
+}
+
+//#endregion
+export { branchScopedDbMiddleware, getPoolFromClient, isProjectDeleteOperation };

package/dist/middleware/cors.d.ts

@@ -0,0 +1,36 @@
+import { cors } from "hono/cors";
+
+//#region src/middleware/cors.d.ts
+type CorsOptions = Parameters<typeof cors>[0];
+/**
+ * Extract the base domain from a hostname (e.g., 'app.preview.inkeep.com' -> 'preview.inkeep.com')
+ */
+declare function getBaseDomain(hostname: string): string;
+/**
+ * Check if a request origin is allowed for CORS
+ * Development: Allow any localhost origin
+ * Production: Allow same base domain or configured UI URL
+ */
+declare function isOriginAllowed(origin: string | undefined): origin is string;
+/**
+ * CORS configuration for auth routes (Better Auth, session endpoints)
+ */
+declare const authCorsConfig: CorsOptions;
+/**
+ * CORS configuration for default API routes
+ */
+declare const defaultCorsConfig: CorsOptions;
+/**
+ * CORS configuration for playground routes
+ */
+declare const playgroundCorsConfig: CorsOptions;
+/**
+ * CORS configuration for run routes (streaming, more permissive)
+ */
+declare const runCorsConfig: CorsOptions;
+/**
+ * CORS configuration for SigNoz proxy routes
+ */
+declare const signozCorsConfig: CorsOptions;
+//#endregion
+export { authCorsConfig, defaultCorsConfig, getBaseDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig };

package/dist/middleware/cors.js

@@ -0,0 +1,131 @@
+import { env } from "../env.js";
+
+//#region src/middleware/cors.ts
+/**
+* Extract the base domain from a hostname (e.g., 'app.preview.inkeep.com' -> 'preview.inkeep.com')
+*/
+function getBaseDomain(hostname) {
+	const parts = hostname.split(".");
+	if (parts.length >= 3) return parts.slice(-3).join(".");
+	return hostname;
+}
+/**
+* Check if a request origin is allowed for CORS
+* Development: Allow any localhost origin
+* Production: Allow same base domain or configured UI URL
+*/
+function isOriginAllowed(origin) {
+	if (!origin) return false;
+	try {
+		const requestUrl = new URL(origin);
+		const apiUrl = new URL(env.INKEEP_AGENTS_API_URL || `http://localhost:3002`);
+		const uiUrl = env.INKEEP_AGENTS_MANAGE_UI_URL ? new URL(env.INKEEP_AGENTS_MANAGE_UI_URL) : null;
+		if (requestUrl.hostname === "localhost" || requestUrl.hostname === "127.0.0.1") return true;
+		if (uiUrl && requestUrl.hostname === uiUrl.hostname) return true;
+		if (getBaseDomain(requestUrl.hostname) === getBaseDomain(apiUrl.hostname)) return true;
+		return false;
+	} catch {
+		return false;
+	}
+}
+const originHandler = (origin) => isOriginAllowed(origin) ? origin : null;
+/**
+* CORS configuration for auth routes (Better Auth, session endpoints)
+*/
+const authCorsConfig = {
+	origin: originHandler,
+	allowHeaders: [
+		"content-type",
+		"Content-Type",
+		"authorization",
+		"Authorization",
+		"User-Agent"
+	],
+	allowMethods: [
+		"POST",
+		"GET",
+		"OPTIONS"
+	],
+	exposeHeaders: ["Content-Length"],
+	maxAge: 600,
+	credentials: true
+};
+/**
+* CORS configuration for default API routes
+*/
+const defaultCorsConfig = {
+	origin: originHandler,
+	allowMethods: [
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"OPTIONS",
+		"PATCH"
+	],
+	allowHeaders: ["*"],
+	exposeHeaders: ["Content-Length"],
+	maxAge: 86400,
+	credentials: true
+};
+/**
+* CORS configuration for playground routes
+*/
+const playgroundCorsConfig = {
+	origin: originHandler,
+	allowHeaders: [
+		"content-type",
+		"Content-Type",
+		"authorization",
+		"Authorization",
+		"User-Agent"
+	],
+	allowMethods: ["POST", "OPTIONS"],
+	exposeHeaders: ["Content-Length"],
+	maxAge: 600,
+	credentials: true
+};
+/**
+* CORS configuration for run routes (streaming, more permissive)
+*/
+const runCorsConfig = {
+	origin: "*",
+	allowMethods: [
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"OPTIONS",
+		"PATCH"
+	],
+	allowHeaders: ["*"],
+	exposeHeaders: ["Content-Length"],
+	maxAge: 86400,
+	credentials: true
+};
+/**
+* CORS configuration for SigNoz proxy routes
+*/
+const signozCorsConfig = {
+	origin: originHandler,
+	allowHeaders: [
+		"content-type",
+		"Content-Type",
+		"authorization",
+		"Authorization",
+		"User-Agent",
+		"Cookie",
+		"X-Forwarded-Cookie"
+	],
+	allowMethods: [
+		"GET",
+		"POST",
+		"OPTIONS"
+	],
+	exposeHeaders: ["Content-Length", "Set-Cookie"],
+	maxAge: 600,
+	credentials: true
+};
+
+//#endregion
+export { authCorsConfig, defaultCorsConfig, getBaseDomain, isOriginAllowed, playgroundCorsConfig, runCorsConfig, signozCorsConfig };

package/dist/middleware/errorHandler.d.ts

@@ -0,0 +1,12 @@
+import { Context } from "hono";
+
+//#region src/middleware/errorHandler.d.ts
+
+/**
+ * Global error handler for the Hono application
+ * Handles Zod validation errors, HTTP exceptions, and unexpected errors
+ * Returns RFC 7807 Problem Details format
+ */
+declare function errorHandler(err: Error, c: Context): Promise<Response>;
+//#endregion
+export { errorHandler };

package/dist/middleware/errorHandler.js

@@ -0,0 +1,88 @@
+import { getLogger as getLogger$1 } from "../logger.js";
+import { handleApiError } from "@inkeep/agents-core";
+import { HTTPException } from "hono/http-exception";
+
+//#region src/middleware/errorHandler.ts
+const logger = getLogger$1("error-handler");
+/**
+* Extract Zod validation issues from an error object
+*/
+function extractZodIssues(err) {
+	if (err && typeof err === "object") {
+		if ("cause" in err && err.cause && typeof err.cause === "object" && "issues" in err.cause) {
+			const issues = err.cause.issues;
+			if (Array.isArray(issues)) return issues;
+		}
+		if ("issues" in err && Array.isArray(err.issues)) return err.issues;
+	}
+}
+/**
+* Format Zod validation errors into RFC 7807 problem detail format
+*/
+function formatZodValidationError(c, zodIssues) {
+	c.status(400);
+	c.header("Content-Type", "application/problem+json");
+	c.header("X-Content-Type-Options", "nosniff");
+	return c.json({
+		type: "https://docs.inkeep.com/agents-api/errors#bad_request",
+		title: "Validation Failed",
+		status: 400,
+		detail: "Request validation failed",
+		errors: zodIssues.map((issue) => ({
+			detail: issue.message,
+			pointer: issue.path ? `/${issue.path.join("/")}` : void 0,
+			name: issue.path ? issue.path.join(".") : void 0,
+			reason: issue.message
+		}))
+	});
+}
+/**
+* Log server errors with appropriate context
+*/
+function logServerError(err, path, requestId, status, isExpectedError) {
+	if (!isExpectedError) {
+		const errorMessage = err instanceof Error ? err.message : String(err);
+		const errorStack = err instanceof Error ? err.stack : void 0;
+		logger.error({
+			error: err,
+			message: errorMessage,
+			stack: errorStack,
+			path,
+			requestId
+		}, "Unexpected server error occurred");
+	} else logger.error({
+		error: err,
+		path,
+		requestId,
+		status
+	}, "Server error occurred");
+}
+/**
+* Global error handler for the Hono application
+* Handles Zod validation errors, HTTP exceptions, and unexpected errors
+* Returns RFC 7807 Problem Details format
+*/
+async function errorHandler(err, c) {
+	const isExpectedError = err instanceof HTTPException;
+	const status = isExpectedError ? err.status : 500;
+	const requestId = c.get("requestId") || "unknown";
+	const zodIssues = extractZodIssues(err);
+	if (status === 400 && zodIssues) return formatZodValidationError(c, zodIssues);
+	if (status >= 500) logServerError(err, c.req.path, requestId, status, isExpectedError);
+	const errorResponse = await handleApiError(err, requestId);
+	c.status(errorResponse.status);
+	const responseBody = {
+		...errorResponse.code && { code: errorResponse.code },
+		title: errorResponse.title,
+		status: errorResponse.status,
+		detail: errorResponse.detail,
+		...errorResponse.instance && { instance: errorResponse.instance },
+		...errorResponse.error && { error: errorResponse.error }
+	};
+	c.header("Content-Type", "application/problem+json");
+	c.header("X-Content-Type-Options", "nosniff");
+	return c.body(JSON.stringify(responseBody));
+}
+
+//#endregion
+export { errorHandler };

package/dist/middleware/evalsAuth.d.ts

@@ -0,0 +1,16 @@
+import * as hono2 from "hono";
+import { BaseExecutionContext } from "@inkeep/agents-core";
+
+//#region src/middleware/evalsAuth.d.ts
+
+/**
+ * Middleware to authenticate API requests using Bearer token authentication
+ * First checks if token matches INKEEP_AGENTS_EVAL_API_BYPASS_SECRET,
+ */
+declare const evalApiKeyAuth: () => hono2.MiddlewareHandler<{
+  Variables: {
+    executionContext: BaseExecutionContext;
+  };
+}, string, {}, Response>;
+//#endregion
+export { evalApiKeyAuth };