@inkeep/agents-api 0.58.16 → 0.58.17

package/dist/middleware/manageAuth.d.ts

@@ -1,5 +1,5 @@
 import { BaseExecutionContext } from "@inkeep/agents-core";
-import * as hono17 from "hono";
+import * as hono1 from "hono";
 import { createAuth } from "@inkeep/agents-core/auth";
 
 //#region src/middleware/manageAuth.d.ts
@@ -15,7 +15,7 @@ import { createAuth } from "@inkeep/agents-core/auth";
  * NOTE: Database API keys are intentionally NOT accepted on manage endpoints.
  * API keys are restricted to the run domain only (chat, agent execution).
  */
-declare const manageBearerAuth: () => hono17.MiddlewareHandler<{
+declare const manageBearerAuth: () => hono1.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     userId?: string;
@@ -29,6 +29,6 @@ declare const manageBearerAuth: () => hono17.MiddlewareHandler<{
  * Uses Bearer token → manage bearer auth (bypass secret, session, Slack JWT, internal service),
  * otherwise falls back to session auth.
  */
-declare const manageBearerOrSessionAuth: () => hono17.MiddlewareHandler<any, string, {}, Response>;
+declare const manageBearerOrSessionAuth: () => hono1.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { manageBearerAuth, manageBearerOrSessionAuth };

package/dist/middleware/projectConfig.d.ts

@@ -1,11 +1,11 @@
 import { BaseExecutionContext, ResolvedRef } from "@inkeep/agents-core";
-import * as hono15 from "hono";
+import * as hono3 from "hono";
 
 //#region src/middleware/projectConfig.d.ts
 /**
  * Middleware that fetches the full project definition from the Management API
  */
-declare const projectConfigMiddleware: hono15.MiddlewareHandler<{
+declare const projectConfigMiddleware: hono3.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     resolvedRef: ResolvedRef;
@@ -15,7 +15,7 @@ declare const projectConfigMiddleware: hono15.MiddlewareHandler<{
  * Creates a middleware that applies project config fetching except for specified route patterns
  * @param skipRouteCheck - Function that returns true if the route should skip the middleware
  */
-declare const projectConfigMiddlewareExcept: (skipRouteCheck: (path: string) => boolean) => hono15.MiddlewareHandler<{
+declare const projectConfigMiddlewareExcept: (skipRouteCheck: (path: string) => boolean) => hono3.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
     resolvedRef: ResolvedRef;

package/dist/middleware/requirePermission.d.ts

@@ -1,5 +1,5 @@
 import { ManageAppVariables } from "../types/app.js";
-import * as hono0 from "hono";
+import * as hono5 from "hono";
 
 //#region src/middleware/requirePermission.d.ts
 type Permission = {
@@ -9,6 +9,6 @@ declare const requirePermission: <Env$1 extends {
   Variables: ManageAppVariables;
 } = {
   Variables: ManageAppVariables;
-}>(permissions: Permission) => hono0.MiddlewareHandler<Env$1, string, {}, Response>;
+}>(permissions: Permission) => hono5.MiddlewareHandler<Env$1, string, {}, Response>;
 //#endregion
 export { requirePermission };

package/dist/middleware/runAuth.d.ts

@@ -1,8 +1,8 @@
 import { BaseExecutionContext } from "@inkeep/agents-core";
-import * as hono1 from "hono";
+import * as hono6 from "hono";
 
 //#region src/middleware/runAuth.d.ts
-declare const runApiKeyAuth: () => hono1.MiddlewareHandler<{
+declare const runApiKeyAuth: () => hono6.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };
@@ -11,7 +11,7 @@ declare const runApiKeyAuth: () => hono1.MiddlewareHandler<{
  * Creates a middleware that applies API key authentication except for specified route patterns
  * @param skipRouteCheck - Function that returns true if the route should skip authentication
  */
-declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) => hono1.MiddlewareHandler<{
+declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) => hono6.MiddlewareHandler<{
   Variables: {
     executionContext: BaseExecutionContext;
   };
@@ -20,7 +20,7 @@ declare const runApiKeyAuthExcept: (skipRouteCheck: (path: string) => boolean) =
  * Helper middleware for endpoints that optionally support API key authentication
  * If no auth header is present, it continues without setting the executionContext
  */
-declare const runOptionalAuth: () => hono1.MiddlewareHandler<{
+declare const runOptionalAuth: () => hono6.MiddlewareHandler<{
   Variables: {
     executionContext?: BaseExecutionContext;
   };

package/dist/middleware/sessionAuth.d.ts

@@ -1,4 +1,4 @@
-import * as hono4 from "hono";
+import * as hono9 from "hono";
 
 //#region src/middleware/sessionAuth.d.ts
 
@@ -7,11 +7,11 @@ import * as hono4 from "hono";
  * Requires that a user has already been authenticated via Better Auth session.
  * Used primarily for manage routes that require an active user session.
  */
-declare const sessionAuth: () => hono4.MiddlewareHandler<any, string, {}, Response>;
+declare const sessionAuth: () => hono9.MiddlewareHandler<any, string, {}, Response>;
 /**
  * Global session middleware - sets user and session in context for all routes
  * Used for all routes that require an active user session.
  */
-declare const sessionContext: () => hono4.MiddlewareHandler<any, string, {}, Response>;
+declare const sessionContext: () => hono9.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { sessionAuth, sessionContext };

package/dist/middleware/tenantAccess.d.ts

@@ -1,4 +1,4 @@
-import * as hono6 from "hono";
+import * as hono11 from "hono";
 
 //#region src/middleware/tenantAccess.d.ts
 
@@ -12,7 +12,7 @@ import * as hono6 from "hono";
  * - API key user: Access only to the tenant associated with the API key
  * - Session user: Access based on organization membership
  */
-declare const requireTenantAccess: () => hono6.MiddlewareHandler<{
+declare const requireTenantAccess: () => hono11.MiddlewareHandler<{
   Variables: {
     userId: string;
     tenantId: string;

package/dist/middleware/tracing.d.ts

@@ -1,7 +1,7 @@
-import * as hono7 from "hono";
+import * as hono12 from "hono";
 
 //#region src/middleware/tracing.d.ts
-declare const otelBaggageMiddleware: () => hono7.MiddlewareHandler<any, string, {}, Response>;
-declare const executionBaggageMiddleware: () => hono7.MiddlewareHandler<any, string, {}, Response>;
+declare const otelBaggageMiddleware: () => hono12.MiddlewareHandler<any, string, {}, Response>;
+declare const executionBaggageMiddleware: () => hono12.MiddlewareHandler<any, string, {}, Response>;
 //#endregion
 export { executionBaggageMiddleware, otelBaggageMiddleware };

package/dist/utils/signozHelpers.d.ts

@@ -1,8 +1,7 @@
 //#region src/utils/signozHelpers.d.ts
 /**
- * Helper function to enforce projectId filter on SigNoz queries.
- * This modifies the query payload to ensure all builder queries include
- * a server-side project.id filter, preventing client-side filter bypass.
+ * Enforces server-side filters on SigNoz builder queries.
+ * Scopes to known Inkeep services and prevents tenant/project filter bypass.
  */
 declare function enforceSecurityFilters(payload: any, tenantId: string, projectId?: string): any;
 //#endregion

package/dist/utils/signozHelpers.js

@@ -1,8 +1,8 @@
 //#region src/utils/signozHelpers.ts
+const ALLOWED_SERVICE_NAMES = ["inkeep-agents-api", "inkeep-agents-run-api"];
 /**
-* Helper function to enforce projectId filter on SigNoz queries.
-* This modifies the query payload to ensure all builder queries include
-* a server-side project.id filter, preventing client-side filter bypass.
+* Enforces server-side filters on SigNoz builder queries.
+* Scopes to known Inkeep services and prevents tenant/project filter bypass.
 */
 function enforceSecurityFilters(payload, tenantId, projectId) {
 	const modifiedPayload = JSON.parse(JSON.stringify(payload));
@@ -12,8 +12,18 @@ function enforceSecurityFilters(payload, tenantId, projectId) {
 			op: "AND",
 			items: []
 		};
-		query.filters.items = query.filters.items.filter((item) => item.key?.key !== "tenant.id" && item.key?.key !== "project.id");
+		query.filters.items = query.filters.items.filter((item) => item.key?.key !== "serviceName" && item.key?.key !== "tenant.id" && item.key?.key !== "project.id");
 		query.filters.items.push({
+			key: {
+				key: "serviceName",
+				dataType: "string",
+				type: "resource",
+				isColumn: true,
+				isJSON: false
+			},
+			op: "in",
+			value: ALLOWED_SERVICE_NAMES
+		}, {
 			key: {
 				key: "tenant.id",
 				dataType: "string",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkeep/agents-api",
-  "version": "0.58.16",
+  "version": "0.58.17",
   "description": "Unified Inkeep Agents API - combines management, runtime, and evaluation capabilities",
   "types": "dist/index.d.ts",
   "exports": {
@@ -74,10 +74,10 @@
     "pg": "^8.16.3",
     "undici": "^7.22.0",
     "workflow": "^4.2.0-beta.64",
-    "@inkeep/agents-core": "^0.58.16",
-    "@inkeep/agents-email": "^0.58.16",
-    "@inkeep/agents-mcp": "^0.58.16",
-    "@inkeep/agents-work-apps": "^0.58.16"
+    "@inkeep/agents-core": "^0.58.17",
+    "@inkeep/agents-email": "^0.58.17",
+    "@inkeep/agents-mcp": "^0.58.17",
+    "@inkeep/agents-work-apps": "^0.58.17"
   },
   "peerDependencies": {
     "@hono/zod-openapi": "^1.1.5",