@inkeep/agents-core 0.63.3 → 0.64.1

package/drizzle/manage/meta/_journal.json

@@ -113,6 +113,20 @@
       "when": 1774882222737,
       "tag": "0015_backfill_skill_files",
       "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "7",
+      "when": 1774968024482,
+      "tag": "0016_complex_klaw",
+      "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1774971562824,
+      "tag": "0017_brief_doctor_strange",
+      "breakpoints": true
     }
   ]
 }

package/drizzle/runtime/0029_burly_satana.sql

@@ -0,0 +1,13 @@
+CREATE TABLE "org_entitlement" (
+	"id" varchar(256) PRIMARY KEY NOT NULL,
+	"organization_id" varchar(256) NOT NULL,
+	"resource_type" text NOT NULL,
+	"max_value" integer NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "org_entitlement_org_resource_unique" UNIQUE("organization_id","resource_type"),
+	CONSTRAINT "org_entitlement_resource_type_format" CHECK (resource_type ~ '^[a-z]+:[a-z][a-z0-9_]*$')
+);
+--> statement-breakpoint
+ALTER TABLE "org_entitlement" ADD CONSTRAINT "org_entitlement_organization_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "org_entitlement_org_idx" ON "org_entitlement" USING btree ("organization_id");

package/drizzle/runtime/0030_set-allow-anonymous-for-existing-apps.sql

@@ -0,0 +1,56 @@
+-- Flatten auth config: move fields from webClient.auth.* to webClient.*,
+-- backfill allowAnonymous, and remove validateScopeClaims (now always-on for global apps).
+
+-- Step 1: For apps that have a nested auth object, hoist its fields up to webClient.
+-- This moves publicKeys, audience, and allowAnonymous from webClient.auth to webClient
+-- directly, then removes the auth key. validateScopeClaims is intentionally not hoisted
+-- as it is being removed (scope validation is now always-on for global apps).
+UPDATE apps
+SET config = jsonb_set(
+  jsonb_set(
+    jsonb_set(
+      config #- '{webClient,auth}',
+      '{webClient,publicKeys}',
+      COALESCE(config->'webClient'->'auth'->'publicKeys', '[]'::jsonb)
+    ),
+    '{webClient,audience}',
+    COALESCE(config->'webClient'->'auth'->'audience', 'null'::jsonb)
+  ),
+  '{webClient,allowAnonymous}',
+  COALESCE(config->'webClient'->'auth'->'allowAnonymous', 'null'::jsonb)
+)
+WHERE type = 'web_client'
+  AND config->'webClient'->'auth' IS NOT NULL;--> statement-breakpoint
+-- Step 2: Clean up null-valued fields that were hoisted from a missing auth sub-field.
+UPDATE apps
+SET config = config #- '{webClient,audience}'
+WHERE type = 'web_client'
+  AND config->'webClient'->'audience' = 'null'::jsonb;--> statement-breakpoint
+UPDATE apps
+SET config = config #- '{webClient,allowAnonymous}'
+WHERE type = 'web_client'
+  AND config->'webClient'->'allowAnonymous' = 'null'::jsonb;--> statement-breakpoint
+-- Step 3: Remove validateScopeClaims from all apps (now always-on for global apps).
+UPDATE apps
+SET config = config #- '{webClient,validateScopeClaims}'
+WHERE type = 'web_client'
+  AND config->'webClient'->'validateScopeClaims' IS NOT NULL;--> statement-breakpoint
+-- Step 4: Backfill allowAnonymous=true for apps that still don't have it set
+-- (preserves existing "allow anonymous" behavior for old apps).
+UPDATE apps
+SET config = jsonb_set(
+  config,
+  '{webClient,allowAnonymous}',
+  'true'::jsonb,
+  true
+)
+WHERE type = 'web_client'
+  AND (config->'webClient'->'allowAnonymous') IS NULL;--> statement-breakpoint
+-- Step 5: Set playground app to require authentication.
+UPDATE apps
+SET config = jsonb_set(
+  config,
+  '{webClient,allowAnonymous}',
+  'false'::jsonb
+)
+WHERE id = 'app_playground';