@inkeep/agents-core 0.64.2 → 0.64.6

package/dist/setup/setup.js

@@ -564,17 +564,21 @@ async function runSetup(config) {
 	await runMigrations(config);
 	logStep(5, "Initializing authentication");
 	await initAuth(config.authInitCommand);
-	if (config.pushProject && !config.skipPush) {
-		const resolvedPush = {
-			...config.pushProject,
-			apiKey: config.pushProject.apiKey || process.env.INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET
-		};
+	const pushConfigs = config.pushProject ? Array.isArray(config.pushProject) ? config.pushProject : [config.pushProject] : [];
+	if (pushConfigs.length > 0 && !config.skipPush) {
 		logStep(6, "Checking server availability");
 		const servers = await startServersIfNeeded(config);
-		let pushSuccess = false;
+		let allPushSuccess = true;
 		try {
-			logStep(7, "Pushing project to API");
-			pushSuccess = await pushProject(resolvedPush);
+			logStep(7, "Pushing projects to API");
+			for (const push of pushConfigs) if (!await pushProject({
+				...push,
+				apiKey: push.apiKey || process.env.INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET
+			})) allPushSuccess = false;
+			if (config.afterPush) {
+				const apiUrl = config.apiHealthUrl?.replace("/health", "") || "http://localhost:3002";
+				await config.afterPush(apiUrl);
+			}
 		} finally {
 			if (servers.startedApi || servers.startedUi) {
 				logStep(8, "Cleaning up temporarily started servers");
@@ -583,12 +587,12 @@ async function runSetup(config) {
 			}
 		}
 		console.log(`\n${colors.bright}=== Setup Complete ===${colors.reset}\n`);
-		if (pushSuccess) logSuccess("All steps completed successfully!");
+		if (allPushSuccess) logSuccess("All steps completed successfully!");
 		else logWarning("Setup completed with some warnings. See details above.");
 	} else {
 		console.log(`\n${colors.bright}=== Setup Complete ===${colors.reset}\n`);
 		logSuccess("Database setup completed!");
-		if (!config.pushProject) logInfo("No project push configured. Run \"pnpm dev\" to start development servers.");
+		if (pushConfigs.length === 0) logInfo("No project push configured. Run \"pnpm dev\" to start development servers.");
 	}
 }
 

package/dist/utils/index.d.ts

@@ -1,4 +1,4 @@
-import { JwtVerifyResult, SignJwtOptions, VerifyJwtOptions, decodeJwtPayload, derivePlaygroundKid, extractBearerToken, getJwtSecret, hasIssuer, signJwt, verifyJwt } from "./jwt-helpers.js";
+import { JwtVerifyResult, SignJwtOptions, VerifyJwtOptions, decodeJwtPayload, deriveKidFromPublicKey, extractBearerToken, getJwtSecret, hasIssuer, signJwt, verifyJwt } from "./jwt-helpers.js";
 import { GenerateInternalServiceTokenParams, InternalServiceId, InternalServiceTokenPayload, InternalServices, VerifyInternalServiceTokenResult, generateInternalServiceToken, isInternalServiceToken, validateInternalServiceProjectAccess, validateInternalServiceTenantAccess, verifyInternalServiceAuthHeader, verifyInternalServiceToken } from "./internal-service-auth.js";
 import { GenerationType } from "../db/runtime/runtime-schema.js";
 import { LoggerFactoryConfig, PinoLogger, PinoLoggerConfig, getLogger, loggerFactory } from "./logger.js";
@@ -26,7 +26,7 @@ import { SKILL_ENTRY_FILE_PATH, parseSkillFromMarkdown, serializeSkillToMarkdown
 import { SignSlackLinkTokenParams, SlackLinkIntent, SlackLinkIntentSchema, SlackLinkTokenPayload, SlackLinkTokenPayloadSchema, VerifySlackLinkTokenResult, signSlackLinkToken, verifySlackLinkToken } from "./slack-link-token.js";
 import { SignSlackUserTokenParams, SlackAccessTokenPayload, SlackAccessTokenPayloadSchema, VerifySlackUserTokenResult, isSlackUserToken, signSlackUserToken, verifySlackUserToken } from "./slack-user-token.js";
 import { ParsedSSEResponse, parseSSEResponse } from "./sse-parser.js";
-import { SignedTempToken, TempTokenPayload, signTempToken, verifyTempToken } from "./temp-jwt.js";
+import { TempTokenPayload, verifyTempToken } from "./temp-jwt.js";
 import { interpolateTemplate } from "./template-interpolation.js";
 import { ComposioAuthResult, CredentialScope, configureComposioMCPServer, deleteComposioConnectedAccount, extractComposioServerId, fetchComposioServers, fetchSingleComposioServer, getComposioInstance, getComposioOAuthRedirectUrl, getComposioUserId, isComposioMCPServerAuthenticated } from "./third-party-mcp-servers/composio-client.js";
 import { isThirdPartyMCPServerAuthenticated } from "./third-party-mcp-servers/third-party-check.js";
@@ -39,4 +39,4 @@ import "./usage-tracker.js";
 import { ValidatePublicKeyResult, validatePublicKey } from "./validate-public-key.js";
 import { _resetWaitUntilCache, getWaitUntil } from "./wait-until.js";
 import { TRUSTED_WORK_APP_MCP_PATHS, isTrustedWorkAppMcpUrl } from "./work-app-mcp.js";
-export { ApiKeyGenerationResult, AppCredentialResult, AssembleResult, CommonCreateErrorResponses, CommonDeleteErrorResponses, CommonGetErrorResponses, CommonUpdateErrorResponses, ComposioAuthResult, CredentialScope, ERROR_DOCS_BASE_URL, ErrorCode, ErrorCodes, ErrorResponse, GenerateInternalServiceTokenParams, GenerateServiceTokenParams, GenerationType, HashedHeaderValue, InternalServiceId, InternalServiceTokenPayload, InternalServices, JsonTransformer, JwtVerifyResult, LLMMessage, LoggerFactoryConfig, McpClient, McpClientOptions, McpOAuthFlowResult, McpSSEConfig, McpServerConfig, McpStreamableHttpConfig, McpTokenExchangeResult, MockLanguageModel, ModelFactory, OAuthConfig, ParsedSSEResponse, PinoLogger, PinoLoggerConfig, PoWError, PoWResult, ProblemDetails, SKILL_ENTRY_FILE_PATH, ServiceTokenPayload, SignJwtOptions, SignSlackLinkTokenParams, SignSlackUserTokenParams, SignatureVerificationErrorCode, SignatureVerificationResult, SignedTempToken, SlackAccessTokenPayload, SlackAccessTokenPayloadSchema, SlackLinkIntent, SlackLinkIntentSchema, SlackLinkTokenPayload, SlackLinkTokenPayloadSchema, TRUSTED_WORK_APP_MCP_PATHS, TempTokenPayload, TriggerAuthResult, ValidatePublicKeyResult, VerifyInternalServiceTokenResult, VerifyJwtOptions, VerifyServiceTokenResult, VerifySlackLinkTokenResult, VerifySlackUserTokenResult, _resetWaitUntilCache, activeMcpClients, buildConversationMetadata, commonCreateErrorResponses, commonDeleteErrorResponses, commonGetErrorResponses, commonUpdateErrorResponses, computeNextRunAt, configureComposioMCPServer, convertZodToJsonSchema, convertZodToJsonSchemaWithPreview, createApiError, createMockModel, decodeJwtPayload, deleteComposioConnectedAccount, derivePlaygroundKid, deriveRelationId, detectAuthenticationRequired, errorResponseSchema, errorSchemaFactory, estimateTokens, exchangeMcpAuthorizationCode, extractBearerToken, extractComposioServerId, extractPreviewFields, extractPublicId, extractUsageTokens, fetchComposioServers, fetchSingleComposioServer, flushTraces, formatMessagesForLLM, formatMessagesForLLMContext, gatewayCostMiddleware, generateApiKey, generateAppCredential, generateId, generateInternalServiceToken, generateServiceToken, getComposioInstance, getComposioOAuthRedirectUrl, getComposioUserId, getConversationId, getCredentialStoreLookupKeyFromRetrievalParams, getInProcessFetch, getJwtSecret, getLogger, getMetadataFromApiKey, getPoWErrorMessage, getTracer, getWaitUntil, handleApiError, hasIssuer, hashApiKey, hashAuthenticationHeaders, hashTriggerHeaderValue, initiateMcpOAuthFlow, interpolateTemplate, isApiKeyExpired, isComposioMCPServerAuthenticated, isDevelopment, isInternalServiceToken, isPoWEnabled, isProduction, isSlackUserToken, isTest, isThirdPartyMCPServerAuthenticated, isTrustedWorkAppMcpUrl, isUniqueConstraintError, isZodSchema, loggerFactory, makeAllPropertiesRequired, maskApiKey, normalizeDataComponentSchema, normalizeDateString, normalizeModelId, parseEmbeddedJson, parseSSEResponse, parseSkillFromMarkdown, preview, problemDetailsSchema, registerAppFetch, retryWithBackoff, sanitizeAppConfig, serializeSkillToMarkdown, setSpanWithError, signJwt, signSlackLinkToken, signSlackUserToken, signTempToken, stripUnsupportedConstraints, throwIfUniqueConstraintError, toISODateString, unwrapError, validateApiKey, validateInternalServiceProjectAccess, validateInternalServiceTenantAccess, validateOrigin, validatePublicKey, validateTargetAgent, validateTenantId, validateTriggerHeaderValue, verifyAuthorizationHeader, verifyInternalServiceAuthHeader, verifyInternalServiceToken, verifyJwt, verifyPoW, verifyServiceToken, verifySignatureWithConfig, verifySlackLinkToken, verifySlackUserToken, verifyTempToken, verifyTriggerAuth };
+export { ApiKeyGenerationResult, AppCredentialResult, AssembleResult, CommonCreateErrorResponses, CommonDeleteErrorResponses, CommonGetErrorResponses, CommonUpdateErrorResponses, ComposioAuthResult, CredentialScope, ERROR_DOCS_BASE_URL, ErrorCode, ErrorCodes, ErrorResponse, GenerateInternalServiceTokenParams, GenerateServiceTokenParams, GenerationType, HashedHeaderValue, InternalServiceId, InternalServiceTokenPayload, InternalServices, JsonTransformer, JwtVerifyResult, LLMMessage, LoggerFactoryConfig, McpClient, McpClientOptions, McpOAuthFlowResult, McpSSEConfig, McpServerConfig, McpStreamableHttpConfig, McpTokenExchangeResult, MockLanguageModel, ModelFactory, OAuthConfig, ParsedSSEResponse, PinoLogger, PinoLoggerConfig, PoWError, PoWResult, ProblemDetails, SKILL_ENTRY_FILE_PATH, ServiceTokenPayload, SignJwtOptions, SignSlackLinkTokenParams, SignSlackUserTokenParams, SignatureVerificationErrorCode, SignatureVerificationResult, SlackAccessTokenPayload, SlackAccessTokenPayloadSchema, SlackLinkIntent, SlackLinkIntentSchema, SlackLinkTokenPayload, SlackLinkTokenPayloadSchema, TRUSTED_WORK_APP_MCP_PATHS, TempTokenPayload, TriggerAuthResult, ValidatePublicKeyResult, VerifyInternalServiceTokenResult, VerifyJwtOptions, VerifyServiceTokenResult, VerifySlackLinkTokenResult, VerifySlackUserTokenResult, _resetWaitUntilCache, activeMcpClients, buildConversationMetadata, commonCreateErrorResponses, commonDeleteErrorResponses, commonGetErrorResponses, commonUpdateErrorResponses, computeNextRunAt, configureComposioMCPServer, convertZodToJsonSchema, convertZodToJsonSchemaWithPreview, createApiError, createMockModel, decodeJwtPayload, deleteComposioConnectedAccount, deriveKidFromPublicKey, deriveRelationId, detectAuthenticationRequired, errorResponseSchema, errorSchemaFactory, estimateTokens, exchangeMcpAuthorizationCode, extractBearerToken, extractComposioServerId, extractPreviewFields, extractPublicId, extractUsageTokens, fetchComposioServers, fetchSingleComposioServer, flushTraces, formatMessagesForLLM, formatMessagesForLLMContext, gatewayCostMiddleware, generateApiKey, generateAppCredential, generateId, generateInternalServiceToken, generateServiceToken, getComposioInstance, getComposioOAuthRedirectUrl, getComposioUserId, getConversationId, getCredentialStoreLookupKeyFromRetrievalParams, getInProcessFetch, getJwtSecret, getLogger, getMetadataFromApiKey, getPoWErrorMessage, getTracer, getWaitUntil, handleApiError, hasIssuer, hashApiKey, hashAuthenticationHeaders, hashTriggerHeaderValue, initiateMcpOAuthFlow, interpolateTemplate, isApiKeyExpired, isComposioMCPServerAuthenticated, isDevelopment, isInternalServiceToken, isPoWEnabled, isProduction, isSlackUserToken, isTest, isThirdPartyMCPServerAuthenticated, isTrustedWorkAppMcpUrl, isUniqueConstraintError, isZodSchema, loggerFactory, makeAllPropertiesRequired, maskApiKey, normalizeDataComponentSchema, normalizeDateString, normalizeModelId, parseEmbeddedJson, parseSSEResponse, parseSkillFromMarkdown, preview, problemDetailsSchema, registerAppFetch, retryWithBackoff, sanitizeAppConfig, serializeSkillToMarkdown, setSpanWithError, signJwt, signSlackLinkToken, signSlackUserToken, stripUnsupportedConstraints, throwIfUniqueConstraintError, toISODateString, unwrapError, validateApiKey, validateInternalServiceProjectAccess, validateInternalServiceTenantAccess, validateOrigin, validatePublicKey, validateTargetAgent, validateTenantId, validateTriggerHeaderValue, verifyAuthorizationHeader, verifyInternalServiceAuthHeader, verifyInternalServiceToken, verifyJwt, verifyPoW, verifyServiceToken, verifySignatureWithConfig, verifySlackLinkToken, verifySlackUserToken, verifyTempToken, verifyTriggerAuth };

package/dist/utils/index.js

@@ -1,7 +1,7 @@
 import { SKILL_ENTRY_FILE_PATH, parseSkillFromMarkdown, serializeSkillToMarkdown } from "./skill-files.js";
 import { detectAuthenticationRequired, exchangeMcpAuthorizationCode, initiateMcpOAuthFlow } from "./auth-detection.js";
 import { PinoLogger, getLogger, loggerFactory } from "./logger.js";
-import { decodeJwtPayload, derivePlaygroundKid, extractBearerToken, getJwtSecret, hasIssuer, signJwt, verifyJwt } from "./jwt-helpers.js";
+import { decodeJwtPayload, deriveKidFromPublicKey, extractBearerToken, getJwtSecret, hasIssuer, signJwt, verifyJwt } from "./jwt-helpers.js";
 import { InternalServices, generateInternalServiceToken, isInternalServiceToken, validateInternalServiceProjectAccess, validateInternalServiceTenantAccess, verifyInternalServiceAuthHeader, verifyInternalServiceToken } from "./internal-service-auth.js";
 import { convertZodToJsonSchema, convertZodToJsonSchemaWithPreview, extractPreviewFields, isZodSchema, makeAllPropertiesRequired, normalizeDataComponentSchema, preview, stripUnsupportedConstraints } from "./schema-conversion.js";
 import { configureComposioMCPServer, deleteComposioConnectedAccount, extractComposioServerId, fetchComposioServers, fetchSingleComposioServer, getComposioInstance, getComposioOAuthRedirectUrl, getComposioUserId, isComposioMCPServerAuthenticated } from "./third-party-mcp-servers/composio-client.js";
@@ -29,7 +29,7 @@ import { generateServiceToken, validateTargetAgent, validateTenantId, verifyAuth
 import { SlackLinkIntentSchema, SlackLinkTokenPayloadSchema, signSlackLinkToken, verifySlackLinkToken } from "./slack-link-token.js";
 import { SlackAccessTokenPayloadSchema, isSlackUserToken, signSlackUserToken, verifySlackUserToken } from "./slack-user-token.js";
 import { parseSSEResponse } from "./sse-parser.js";
-import { signTempToken, verifyTempToken } from "./temp-jwt.js";
+import { verifyTempToken } from "./temp-jwt.js";
 import { interpolateTemplate } from "./template-interpolation.js";
 import { estimateTokens } from "./token-estimator.js";
 import { flushTraces, getTracer, setSpanWithError, unwrapError } from "./tracer-factory.js";
@@ -38,4 +38,4 @@ import { validatePublicKey } from "./validate-public-key.js";
 import { _resetWaitUntilCache, getWaitUntil } from "./wait-until.js";
 import { TRUSTED_WORK_APP_MCP_PATHS, isTrustedWorkAppMcpUrl } from "./work-app-mcp.js";
 
-export { ERROR_DOCS_BASE_URL, ErrorCode, InternalServices, JsonTransformer, McpClient, MockLanguageModel, ModelFactory, PinoLogger, SKILL_ENTRY_FILE_PATH, SlackAccessTokenPayloadSchema, SlackLinkIntentSchema, SlackLinkTokenPayloadSchema, TRUSTED_WORK_APP_MCP_PATHS, _resetWaitUntilCache, activeMcpClients, buildConversationMetadata, commonCreateErrorResponses, commonDeleteErrorResponses, commonGetErrorResponses, commonUpdateErrorResponses, computeNextRunAt, configureComposioMCPServer, convertZodToJsonSchema, convertZodToJsonSchemaWithPreview, createApiError, createMockModel, decodeJwtPayload, deleteComposioConnectedAccount, derivePlaygroundKid, deriveRelationId, detectAuthenticationRequired, errorResponseSchema, errorSchemaFactory, estimateTokens, exchangeMcpAuthorizationCode, extractBearerToken, extractComposioServerId, extractPreviewFields, extractPublicId, extractUsageTokens, fetchComposioServers, fetchSingleComposioServer, flushTraces, formatMessagesForLLM, formatMessagesForLLMContext, gatewayCostMiddleware, generateApiKey, generateAppCredential, generateId, generateInternalServiceToken, generateServiceToken, getComposioInstance, getComposioOAuthRedirectUrl, getComposioUserId, getConversationId, getCredentialStoreLookupKeyFromRetrievalParams, getInProcessFetch, getJwtSecret, getLogger, getMetadataFromApiKey, getPoWErrorMessage, getTracer, getWaitUntil, handleApiError, hasIssuer, hashApiKey, hashAuthenticationHeaders, hashTriggerHeaderValue, initiateMcpOAuthFlow, interpolateTemplate, isApiKeyExpired, isComposioMCPServerAuthenticated, isDevelopment, isInternalServiceToken, isPoWEnabled, isProduction, isSlackUserToken, isTest, isThirdPartyMCPServerAuthenticated, isTrustedWorkAppMcpUrl, isUniqueConstraintError, isZodSchema, loggerFactory, makeAllPropertiesRequired, maskApiKey, normalizeDataComponentSchema, normalizeDateString, normalizeModelId, parseEmbeddedJson, parseSSEResponse, parseSkillFromMarkdown, preview, problemDetailsSchema, registerAppFetch, retryWithBackoff, sanitizeAppConfig, serializeSkillToMarkdown, setSpanWithError, signJwt, signSlackLinkToken, signSlackUserToken, signTempToken, stripUnsupportedConstraints, throwIfUniqueConstraintError, toISODateString, unwrapError, validateApiKey, validateInternalServiceProjectAccess, validateInternalServiceTenantAccess, validateOrigin, validatePublicKey, validateTargetAgent, validateTenantId, validateTriggerHeaderValue, verifyAuthorizationHeader, verifyInternalServiceAuthHeader, verifyInternalServiceToken, verifyJwt, verifyPoW, verifyServiceToken, verifySignatureWithConfig, verifySlackLinkToken, verifySlackUserToken, verifyTempToken, verifyTriggerAuth };
+export { ERROR_DOCS_BASE_URL, ErrorCode, InternalServices, JsonTransformer, McpClient, MockLanguageModel, ModelFactory, PinoLogger, SKILL_ENTRY_FILE_PATH, SlackAccessTokenPayloadSchema, SlackLinkIntentSchema, SlackLinkTokenPayloadSchema, TRUSTED_WORK_APP_MCP_PATHS, _resetWaitUntilCache, activeMcpClients, buildConversationMetadata, commonCreateErrorResponses, commonDeleteErrorResponses, commonGetErrorResponses, commonUpdateErrorResponses, computeNextRunAt, configureComposioMCPServer, convertZodToJsonSchema, convertZodToJsonSchemaWithPreview, createApiError, createMockModel, decodeJwtPayload, deleteComposioConnectedAccount, deriveKidFromPublicKey, deriveRelationId, detectAuthenticationRequired, errorResponseSchema, errorSchemaFactory, estimateTokens, exchangeMcpAuthorizationCode, extractBearerToken, extractComposioServerId, extractPreviewFields, extractPublicId, extractUsageTokens, fetchComposioServers, fetchSingleComposioServer, flushTraces, formatMessagesForLLM, formatMessagesForLLMContext, gatewayCostMiddleware, generateApiKey, generateAppCredential, generateId, generateInternalServiceToken, generateServiceToken, getComposioInstance, getComposioOAuthRedirectUrl, getComposioUserId, getConversationId, getCredentialStoreLookupKeyFromRetrievalParams, getInProcessFetch, getJwtSecret, getLogger, getMetadataFromApiKey, getPoWErrorMessage, getTracer, getWaitUntil, handleApiError, hasIssuer, hashApiKey, hashAuthenticationHeaders, hashTriggerHeaderValue, initiateMcpOAuthFlow, interpolateTemplate, isApiKeyExpired, isComposioMCPServerAuthenticated, isDevelopment, isInternalServiceToken, isPoWEnabled, isProduction, isSlackUserToken, isTest, isThirdPartyMCPServerAuthenticated, isTrustedWorkAppMcpUrl, isUniqueConstraintError, isZodSchema, loggerFactory, makeAllPropertiesRequired, maskApiKey, normalizeDataComponentSchema, normalizeDateString, normalizeModelId, parseEmbeddedJson, parseSSEResponse, parseSkillFromMarkdown, preview, problemDetailsSchema, registerAppFetch, retryWithBackoff, sanitizeAppConfig, serializeSkillToMarkdown, setSpanWithError, signJwt, signSlackLinkToken, signSlackUserToken, stripUnsupportedConstraints, throwIfUniqueConstraintError, toISODateString, unwrapError, validateApiKey, validateInternalServiceProjectAccess, validateInternalServiceTenantAccess, validateOrigin, validatePublicKey, validateTargetAgent, validateTenantId, validateTriggerHeaderValue, verifyAuthorizationHeader, verifyInternalServiceAuthHeader, verifyInternalServiceToken, verifyJwt, verifyPoW, verifyServiceToken, verifySignatureWithConfig, verifySlackLinkToken, verifySlackUserToken, verifyTempToken, verifyTriggerAuth };

package/dist/utils/jwt-helpers.d.ts

@@ -54,9 +54,8 @@ declare function decodeJwtPayload(token: string): Record<string, unknown> | null
 declare function hasIssuer(token: string, issuer: string): boolean;
 /**
  * Derive a deterministic kid from a PEM-encoded public key.
- * Used for playground app key registration and token signing.
  * The kid is a truncated SHA-256 hash prefixed with 'pg-'.
  */
-declare function derivePlaygroundKid(publicKeyPem: string): Promise<string>;
+declare function deriveKidFromPublicKey(publicKeyPem: string): Promise<string>;
 //#endregion
-export { JwtVerifyResult, SignJwtOptions, VerifyJwtOptions, decodeJwtPayload, derivePlaygroundKid, extractBearerToken, getJwtSecret, hasIssuer, signJwt, verifyJwt };
+export { JwtVerifyResult, SignJwtOptions, VerifyJwtOptions, decodeJwtPayload, deriveKidFromPublicKey, extractBearerToken, getJwtSecret, hasIssuer, signJwt, verifyJwt };

package/dist/utils/jwt-helpers.js

@@ -87,14 +87,13 @@ function hasIssuer(token, issuer) {
 }
 /**
 * Derive a deterministic kid from a PEM-encoded public key.
-* Used for playground app key registration and token signing.
 * The kid is a truncated SHA-256 hash prefixed with 'pg-'.
 */
-async function derivePlaygroundKid(publicKeyPem) {
+async function deriveKidFromPublicKey(publicKeyPem) {
 	const data = new TextEncoder().encode(publicKeyPem);
 	const hashBuffer = await crypto.subtle.digest("SHA-256", data);
 	return `pg-${Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("").substring(0, 12)}`;
 }
 
 //#endregion
-export { decodeJwtPayload, derivePlaygroundKid, extractBearerToken, getJwtSecret, hasIssuer, signJwt, verifyJwt };
+export { decodeJwtPayload, deriveKidFromPublicKey, extractBearerToken, getJwtSecret, hasIssuer, signJwt, verifyJwt };

package/dist/utils/retry-client.d.ts

@@ -0,0 +1,8 @@
+//#region src/utils/retry-client.d.ts
+declare function retryWithBackoff<T>(fn: () => Promise<T>, opts?: {
+  maxAttempts?: number;
+  maxDelayMs?: number;
+  label?: string;
+}): Promise<T>;
+//#endregion
+export { retryWithBackoff };

package/dist/utils/retry-client.js

@@ -0,0 +1,29 @@
+//#region src/utils/retry-client.ts
+function isRetryableHttpError(error) {
+	if (error instanceof TypeError) return true;
+	if (error != null && typeof error === "object") {
+		if ("name" in error && error.name === "AbortError") return true;
+		const status = error.status;
+		if (typeof status === "number" && (status === 429 || status >= 500)) return true;
+	}
+	return false;
+}
+async function retryWithBackoff(fn, opts = {}) {
+	const { maxAttempts = 3, maxDelayMs = 3e4, label = "operation" } = opts;
+	for (let attempt = 1; attempt <= maxAttempts; attempt++) try {
+		return await fn();
+	} catch (error) {
+		if (!isRetryableHttpError(error) || attempt === maxAttempts) throw error;
+		const status = error.status;
+		const retryAfter = error.headers?.get?.("Retry-After");
+		const retryAfterMs = retryAfter ? (Number(retryAfter) || 0) * 1e3 : 0;
+		const baseDelay = Math.min(500 * 2 ** (attempt - 1), maxDelayMs);
+		const delay = Math.max(baseDelay, retryAfterMs) + Math.random() * 100;
+		console.warn(`[${label}] Retrying after transient failure (attempt ${attempt}/${maxAttempts}, status=${status ?? "n/a"}, delay=${Math.round(delay)}ms)`);
+		await new Promise((resolve) => setTimeout(resolve, delay));
+	}
+	throw new Error("Unreachable");
+}
+
+//#endregion
+export { retryWithBackoff };

package/dist/utils/service-token-auth.d.ts

@@ -21,6 +21,8 @@ interface ServiceTokenPayload {
     type: 'user' | 'api_key';
     id: string;
   };
+  /** App ID - propagated through delegation chain for app-scoped requests */
+  appId?: string;
   /** Issued at timestamp */
   iat: number;
   /** Expiration timestamp (5 minutes from issue) */
@@ -38,6 +40,7 @@ interface GenerateServiceTokenParams {
     type: 'user' | 'api_key';
     id: string;
   };
+  appId?: string;
 }
 /**
  * Result of verifying a service token

package/dist/utils/service-token-auth.js

@@ -18,7 +18,8 @@ async function generateServiceToken(params) {
 			claims: {
 				tenantId: params.tenantId,
 				projectId: params.projectId,
-				...params.initiatedBy ? { initiatedBy: params.initiatedBy } : {}
+				...params.initiatedBy ? { initiatedBy: params.initiatedBy } : {},
+				...params.appId ? { appId: params.appId } : {}
 			}
 		});
 		logger.debug({
@@ -52,7 +53,8 @@ async function verifyServiceToken(token) {
 			error: "Invalid token: missing required claims"
 		};
 	}
-	const initiatedBy = payload.initiatedBy;
+	const initiatedBy = payload.initiatedBy && typeof payload.initiatedBy === "object" && "type" in payload.initiatedBy && "id" in payload.initiatedBy && (payload.initiatedBy.type === "user" || payload.initiatedBy.type === "api_key") && typeof payload.initiatedBy.id === "string" ? payload.initiatedBy : void 0;
+	const appId = typeof payload.appId === "string" ? payload.appId : void 0;
 	const validPayload = {
 		iss: payload.iss,
 		aud: payload.aud,
@@ -60,6 +62,7 @@ async function verifyServiceToken(token) {
 		tenantId: payload.tenantId,
 		projectId: payload.projectId,
 		...initiatedBy ? { initiatedBy } : {},
+		...appId ? { appId } : {},
 		iat: payload.iat,
 		exp: payload.exp
 	};

package/dist/utils/temp-jwt.d.ts

@@ -10,11 +10,6 @@ interface TempTokenPayload {
   };
   sub: string;
 }
-interface SignedTempToken {
-  token: string;
-  expiresAt: string;
-}
-declare function signTempToken(privateKeyPem: string, payload: TempTokenPayload): Promise<SignedTempToken>;
 declare function verifyTempToken(publicKeyPem: string, token: string): Promise<TempTokenPayload>;
 //#endregion
-export { SignedTempToken, TempTokenPayload, signTempToken, verifyTempToken };
+export { TempTokenPayload, verifyTempToken };

package/dist/utils/temp-jwt.js

@@ -1,17 +1,6 @@
-import { generateId } from "./conversations.js";
 import * as jose from "jose";
 
 //#region src/utils/temp-jwt.ts
-async function signTempToken(privateKeyPem, payload) {
-	const privateKey = await jose.importPKCS8(privateKeyPem, "RS256");
-	return {
-		token: await new jose.SignJWT(payload).setProtectedHeader({
-			alg: "RS256",
-			typ: "JWT"
-		}).setIssuedAt().setExpirationTime("1h").setIssuer("inkeep-manage-api").setAudience("inkeep-run-api").setSubject(payload.sub).setJti(generateId()).sign(privateKey),
-		expiresAt: new Date(Date.now() + 3600 * 1e3).toISOString()
-	};
-}
 async function verifyTempToken(publicKeyPem, token) {
 	const publicKey = await jose.importSPKI(publicKeyPem, "RS256");
 	const { payload } = await jose.jwtVerify(token, publicKey, {
@@ -24,4 +13,4 @@ async function verifyTempToken(publicKeyPem, token) {
 }
 
 //#endregion
-export { signTempToken, verifyTempToken };
+export { verifyTempToken };

package/dist/utils/work-app-mcp.js

@@ -8,8 +8,7 @@ const isTrustedWorkAppMcpUrl = (url, path, baseUrl) => {
 	try {
 		const toolUrl = new URL(String(url));
 		const base = new URL(baseUrl);
-		const baseDomain = base.hostname.split(".").slice(-2).join(".");
-		return (toolUrl.hostname === base.hostname || toolUrl.hostname.endsWith(`.${baseDomain}`)) && toolUrl.pathname === path;
+		return toolUrl.origin === base.origin && toolUrl.pathname === path;
 	} catch {
 		return false;
 	}

package/dist/validation/schemas/skills.d.ts

@@ -1,5 +1,5 @@
 import { z } from "@hono/zod-openapi";
-import * as drizzle_orm_pg_core2150 from "drizzle-orm/pg-core";
+import * as drizzle_orm_pg_core1810 from "drizzle-orm/pg-core";
 import * as drizzle_zod367 from "drizzle-zod";
 
 //#region src/validation/schemas/skills.d.ts
@@ -28,7 +28,7 @@ declare const SkillFileContentInputSchema: z.ZodObject<{
   content: z.ZodString;
 }, z.core.$strip>;
 declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
-  createdAt: drizzle_orm_pg_core2150.PgColumn<{
+  createdAt: drizzle_orm_pg_core1810.PgColumn<{
     name: "created_at";
     tableName: "skill_files";
     dataType: "string";
@@ -45,7 +45,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
     identity: undefined;
     generated: undefined;
   }, {}, {}>;
-  updatedAt: drizzle_orm_pg_core2150.PgColumn<{
+  updatedAt: drizzle_orm_pg_core1810.PgColumn<{
     name: "updated_at";
     tableName: "skill_files";
     dataType: "string";
@@ -62,7 +62,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
     identity: undefined;
     generated: undefined;
   }, {}, {}>;
-  skillId: drizzle_orm_pg_core2150.PgColumn<{
+  skillId: drizzle_orm_pg_core1810.PgColumn<{
     name: "skill_id";
     tableName: "skill_files";
     dataType: "string";
@@ -81,7 +81,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
   }, {}, {
     length: 64;
   }>;
-  filePath: drizzle_orm_pg_core2150.PgColumn<{
+  filePath: drizzle_orm_pg_core1810.PgColumn<{
     name: "file_path";
     tableName: "skill_files";
     dataType: "string";
@@ -100,7 +100,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
   }, {}, {
     length: 1024;
   }>;
-  content: drizzle_orm_pg_core2150.PgColumn<{
+  content: drizzle_orm_pg_core1810.PgColumn<{
     name: "content";
     tableName: "skill_files";
     dataType: "string";
@@ -117,7 +117,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
     identity: undefined;
     generated: undefined;
   }, {}, {}>;
-  projectId: drizzle_orm_pg_core2150.PgColumn<{
+  projectId: drizzle_orm_pg_core1810.PgColumn<{
     name: "project_id";
     tableName: "skill_files";
     dataType: "string";
@@ -136,7 +136,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
   }, {}, {
     length: 256;
   }>;
-  tenantId: drizzle_orm_pg_core2150.PgColumn<{
+  tenantId: drizzle_orm_pg_core1810.PgColumn<{
     name: "tenant_id";
     tableName: "skill_files";
     dataType: "string";
@@ -155,7 +155,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
   }, {}, {
     length: 256;
   }>;
-  id: drizzle_orm_pg_core2150.PgColumn<{
+  id: drizzle_orm_pg_core1810.PgColumn<{
     name: "id";
     tableName: "skill_files";
     dataType: "string";
@@ -175,7 +175,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
     length: 256;
   }>;
 }, drizzle_zod367.BuildRefine<{
-  createdAt: drizzle_orm_pg_core2150.PgColumn<{
+  createdAt: drizzle_orm_pg_core1810.PgColumn<{
     name: "created_at";
     tableName: "skill_files";
     dataType: "string";
@@ -192,7 +192,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
     identity: undefined;
     generated: undefined;
   }, {}, {}>;
-  updatedAt: drizzle_orm_pg_core2150.PgColumn<{
+  updatedAt: drizzle_orm_pg_core1810.PgColumn<{
     name: "updated_at";
     tableName: "skill_files";
     dataType: "string";
@@ -209,7 +209,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
     identity: undefined;
     generated: undefined;
   }, {}, {}>;
-  skillId: drizzle_orm_pg_core2150.PgColumn<{
+  skillId: drizzle_orm_pg_core1810.PgColumn<{
     name: "skill_id";
     tableName: "skill_files";
     dataType: "string";
@@ -228,7 +228,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
   }, {}, {
     length: 64;
   }>;
-  filePath: drizzle_orm_pg_core2150.PgColumn<{
+  filePath: drizzle_orm_pg_core1810.PgColumn<{
     name: "file_path";
     tableName: "skill_files";
     dataType: "string";
@@ -247,7 +247,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
   }, {}, {
     length: 1024;
   }>;
-  content: drizzle_orm_pg_core2150.PgColumn<{
+  content: drizzle_orm_pg_core1810.PgColumn<{
     name: "content";
     tableName: "skill_files";
     dataType: "string";
@@ -264,7 +264,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
     identity: undefined;
     generated: undefined;
   }, {}, {}>;
-  projectId: drizzle_orm_pg_core2150.PgColumn<{
+  projectId: drizzle_orm_pg_core1810.PgColumn<{
     name: "project_id";
     tableName: "skill_files";
     dataType: "string";
@@ -283,7 +283,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
   }, {}, {
     length: 256;
   }>;
-  tenantId: drizzle_orm_pg_core2150.PgColumn<{
+  tenantId: drizzle_orm_pg_core1810.PgColumn<{
     name: "tenant_id";
     tableName: "skill_files";
     dataType: "string";
@@ -302,7 +302,7 @@ declare const SkillFileSelectSchema: drizzle_zod367.BuildSchema<"select", {
   }, {}, {
     length: 256;
   }>;
-  id: drizzle_orm_pg_core2150.PgColumn<{
+  id: drizzle_orm_pg_core1810.PgColumn<{
     name: "id";
     tableName: "skill_files";
     dataType: "string";
@@ -413,8 +413,8 @@ declare const SkillFileApiSelectSchema: z.ZodObject<{
   createdAt: z.ZodString;
   updatedAt: z.ZodString;
   content: z.ZodString;
-  skillId: z.ZodString;
   filePath: z.ZodString;
+  skillId: z.ZodString;
 }, z.core.$strip>;
 declare const SkillFileApiInsertSchema: z.ZodObject<{
   filePath: z.ZodString;
@@ -436,8 +436,8 @@ declare const SkillWithFilesApiSelectSchema: z.ZodObject<{
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
     content: z.ZodString;
-    skillId: z.ZodString;
     filePath: z.ZodString;
+    skillId: z.ZodString;
   }, z.core.$strip>>;
 }, z.core.$strip>;
 declare const SubAgentSkillSelectSchema: z.ZodObject<{
@@ -490,16 +490,16 @@ declare const SubAgentSkillApiSelectSchema: z.ZodObject<{
   createdAt: z.ZodString;
   updatedAt: z.ZodString;
   subAgentId: z.ZodString;
-  skillId: z.ZodString;
   index: z.ZodInt;
   alwaysLoaded: z.ZodBoolean;
+  skillId: z.ZodString;
 }, z.core.$strip>;
 declare const SubAgentSkillApiInsertSchema: z.ZodObject<{
   agentId: z.ZodString;
   subAgentId: z.ZodString;
-  skillId: z.ZodString;
   index: z.ZodInt;
   alwaysLoaded: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+  skillId: z.ZodString;
 }, {
   out: {};
   in: {};
@@ -509,9 +509,9 @@ declare const SubAgentSkillApiUpdateSchema: z.ZodObject<{
   createdAt: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodString>>>;
   updatedAt: z.ZodOptional<z.ZodOptional<z.ZodOptional<z.ZodString>>>;
   subAgentId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
-  skillId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
   index: z.ZodOptional<z.ZodOptional<z.ZodInt>>;
   alwaysLoaded: z.ZodOptional<z.ZodOptional<z.ZodDefault<z.ZodOptional<z.ZodBoolean>>>>;
+  skillId: z.ZodOptional<z.ZodOptional<z.ZodString>>;
 }, z.core.$strip>;
 declare const SubAgentSkillWithIndexSchema: z.ZodObject<{
   id: z.ZodString;
@@ -532,8 +532,8 @@ declare const SkillFileResponse: z.ZodObject<{
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
     content: z.ZodString;
-    skillId: z.ZodString;
     filePath: z.ZodString;
+    skillId: z.ZodString;
   }, z.core.$strip>;
 }, z.core.$strip>;
 declare const SkillWithFilesResponse: z.ZodObject<{
@@ -550,8 +550,8 @@ declare const SkillWithFilesResponse: z.ZodObject<{
       createdAt: z.ZodString;
       updatedAt: z.ZodString;
       content: z.ZodString;
-      skillId: z.ZodString;
       filePath: z.ZodString;
+      skillId: z.ZodString;
     }, z.core.$strip>>;
   }, z.core.$strip>;
 }, z.core.$strip>;
@@ -578,9 +578,9 @@ declare const SubAgentSkillResponse: z.ZodObject<{
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
     subAgentId: z.ZodString;
-    skillId: z.ZodString;
     index: z.ZodInt;
     alwaysLoaded: z.ZodBoolean;
+    skillId: z.ZodString;
   }, z.core.$strip>;
 }, z.core.$strip>;
 declare const SubAgentSkillWithIndexArrayResponse: z.ZodObject<{