@inkeep/agents-manage-api 0.0.0-dev-20251125061854 → 0.0.0-dev-20251125083010

package/dist/{chunk-QKQOZRHG.js → chunk-T4UJH26R.js}

@@ -1,5 +1,5 @@
 import { F, u, R, x, T, h, U, L, or, C, Vr, ce, ur, P } from './chunk-SBJLXGYG.js';
-import { loadEnvironmentFiles, getLogger, createDatabaseClient, commonGetErrorResponses, AgentListResponse, PaginationQueryParamsSchema, TenantProjectParamsSchema, listAgents, AgentResponse, TenantProjectIdParamsSchema, getAgentById, createApiError, RelatedAgentInfoListResponse, TenantProjectAgentSubAgentParamsSchema, getAgentSubAgentInfos, AgentWithinContextOfProjectResponse, TenantProjectAgentParamsSchema, getFullAgentDefinition, AgentApiInsertSchema, createAgent, generateId, AgentApiUpdateSchema, updateAgent, ErrorResponseSchema, deleteAgent, AgentWithinContextOfProjectSchema, createFullAgentServerSide, getFullAgent, updateFullAgentServerSide, deleteFullAgent, ApiKeyListResponse, listApiKeysPaginated, ApiKeyResponse, getApiKeyById, ApiKeyApiCreationResponseSchema, ApiKeyApiInsertSchema, generateApiKey, createApiKey, ApiKeyApiUpdateSchema, updateApiKey, deleteApiKey, ArtifactComponentListResponse, listArtifactComponentsPaginated, ArtifactComponentResponse, getArtifactComponentById, ArtifactComponentApiInsertSchema, validatePropsAsJsonSchema, createArtifactComponent, ArtifactComponentApiUpdateSchema, updateArtifactComponent, deleteArtifactComponent, ContextConfigListResponse, listContextConfigsPaginated, ContextConfigResponse, TenantProjectAgentIdParamsSchema, getContextConfigById, ContextConfigApiInsertSchema, createContextConfig, commonUpdateErrorResponses, ContextConfigApiUpdateSchema, updateContextConfig, commonDeleteErrorResponses, deleteContextConfig, getConversationHistory, formatMessagesForLLMContext, CredentialStoreListResponseSchema, CreateCredentialInStoreResponseSchema, CreateCredentialInStoreRequestSchema, CredentialReferenceListResponse, listCredentialReferencesPaginated, ListResponseSchema, CredentialReferenceApiSelectSchema, CredentialReferenceResponse, getCredentialReferenceWithResources, CredentialReferenceApiInsertSchema, createCredentialReference, CredentialReferenceApiUpdateSchema, updateCredentialReference, getCredentialReferenceById, getCredentialStoreLookupKeyFromRetrievalParams, deleteCredentialReference, DataComponentListResponse, listDataComponentsPaginated, DataComponentResponse, getDataComponent, DataComponentApiInsertSchema, createDataComponent, DataComponentApiUpdateSchema, updateDataComponent, deleteDataComponent, ExternalAgentListResponse, listExternalAgentsPaginated, ExternalAgentResponse, getExternalAgent, ExternalAgentApiInsertSchema, createExternalAgent, ExternalAgentApiUpdateSchema, updateExternalAgent, deleteExternalAgent, FunctionListResponse, listFunctions, FunctionResponse, getFunction, FunctionApiInsertSchema, upsertFunction, FunctionApiUpdateSchema, deleteFunction, FunctionToolListResponse, listFunctionTools, FunctionToolResponse, getFunctionToolById, FunctionToolApiInsertSchema, createFunctionTool, FunctionToolApiUpdateSchema, updateFunctionTool, deleteFunctionTool, MCPCatalogListResponse, fetchComposioServers, MCPTransportType, ProjectListResponse, TenantParamsSchema, listProjectsPaginated, ProjectResponse, TenantIdParamsSchema, getProject, ProjectApiInsertSchema, createProject, ProjectApiUpdateSchema, updateProject, deleteProject, ArtifactComponentArrayResponse, getArtifactComponentsForAgent, ComponentAssociationListResponse, getAgentsUsingArtifactComponent, SubAgentArtifactComponentResponse, SubAgentArtifactComponentApiInsertSchema, getSubAgentById, isArtifactComponentAssociatedWithAgent, associateArtifactComponentWithAgent, RemovedResponseSchema, removeArtifactComponentFromAgent, ExistsResponseSchema, DataComponentArrayResponse, getDataComponentsForAgent, getAgentsUsingDataComponent, SubAgentDataComponentResponse, SubAgentDataComponentApiInsertSchema, isDataComponentAssociatedWithAgent, associateDataComponentWithAgent, removeDataComponentFromAgent, SubAgentExternalAgentRelationListResponse, listSubAgentExternalAgentRelations, SubAgentExternalAgentRelationResponse, TenantProjectAgentSubAgentIdParamsSchema, getSubAgentExternalAgentRelationById, SubAgentExternalAgentRelationApiInsertSchema, createSubAgentExternalAgentRelation, SubAgentExternalAgentRelationApiUpdateSchema, updateSubAgentExternalAgentRelation, deleteSubAgentExternalAgentRelation, SubAgentRelationListResponse, SubAgentRelationQuerySchema, getAgentRelationsBySource, getSubAgentRelationsByTarget, listAgentRelations, SubAgentRelationResponse, getAgentRelationById, SubAgentRelationApiInsertSchema, validateSubAgent, createSubAgentRelation, SubAgentRelationApiUpdateSchema, updateAgentRelation, deleteSubAgentRelation, SubAgentListResponse, listSubAgentsPaginated, SubAgentResponse, SubAgentApiInsertSchema, createSubAgent, SubAgentApiUpdateSchema, updateSubAgent, deleteSubAgent, SubAgentIsDefaultError, SubAgentTeamAgentRelationListResponse, listSubAgentTeamAgentRelations, SubAgentTeamAgentRelationResponse, getSubAgentTeamAgentRelationById, SubAgentTeamAgentRelationApiInsertSchema, createSubAgentTeamAgentRelation, SubAgentTeamAgentRelationApiUpdateSchema, updateSubAgentTeamAgentRelation, deleteSubAgentTeamAgentRelation, SubAgentToolRelationListResponse, getAgentToolRelationByAgent, getAgentToolRelationByTool, listAgentToolRelations, SubAgentToolRelationResponse, getAgentToolRelationById, getAgentsForTool, SubAgentToolRelationApiInsertSchema, createAgentToolRelation, SubAgentToolRelationApiUpdateSchema, updateAgentToolRelation, deleteAgentToolRelation, ThirdPartyMCPServerResponse, fetchSingleComposioServer, McpToolListResponse, ToolStatusSchema, listTools, dbResultToMcpTool, McpToolResponse, getToolById, ToolApiInsertSchema, createTool, ToolApiUpdateSchema, updateTool, deleteTool, getPendingInvitationsByEmail, OAuthLoginQuerySchema, OAuthCallbackQuerySchema, CredentialStoreType, projectExists, signTempToken, FullProjectDefinitionResponse, FullProjectDefinitionSchema, createFullProjectServerSide, getFullProject, updateFullProjectServerSide, deleteFullProject, getUserOrganizations, addUserToOrganization, initiateMcpOAuthFlow, exchangeMcpAuthorizationCode, handleApiError, organization, getUserByEmail, member, createDefaultCredentialStores, CredentialStoreRegistry } from '@inkeep/agents-core';
+import { loadEnvironmentFiles, createDatabaseClient, getLogger, commonGetErrorResponses, AgentListResponse, PaginationQueryParamsSchema, TenantProjectParamsSchema, listAgents, AgentResponse, TenantProjectIdParamsSchema, getAgentById, createApiError, RelatedAgentInfoListResponse, TenantProjectAgentSubAgentParamsSchema, getAgentSubAgentInfos, AgentWithinContextOfProjectResponse, TenantProjectAgentParamsSchema, getFullAgentDefinition, AgentApiInsertSchema, createAgent, generateId, AgentApiUpdateSchema, updateAgent, ErrorResponseSchema, deleteAgent, AgentWithinContextOfProjectSchema, createFullAgentServerSide, getFullAgent, updateFullAgentServerSide, deleteFullAgent, ApiKeyListResponse, listApiKeysPaginated, ApiKeyResponse, getApiKeyById, ApiKeyApiCreationResponseSchema, ApiKeyApiInsertSchema, generateApiKey, createApiKey, ApiKeyApiUpdateSchema, updateApiKey, deleteApiKey, ArtifactComponentListResponse, listArtifactComponentsPaginated, ArtifactComponentResponse, getArtifactComponentById, ArtifactComponentApiInsertSchema, validatePropsAsJsonSchema, createArtifactComponent, ArtifactComponentApiUpdateSchema, updateArtifactComponent, deleteArtifactComponent, ContextConfigListResponse, listContextConfigsPaginated, ContextConfigResponse, TenantProjectAgentIdParamsSchema, getContextConfigById, ContextConfigApiInsertSchema, createContextConfig, commonUpdateErrorResponses, ContextConfigApiUpdateSchema, updateContextConfig, commonDeleteErrorResponses, deleteContextConfig, getConversationHistory, formatMessagesForLLMContext, CredentialStoreListResponseSchema, CreateCredentialInStoreResponseSchema, CreateCredentialInStoreRequestSchema, CredentialReferenceListResponse, listCredentialReferencesPaginated, ListResponseSchema, CredentialReferenceApiSelectSchema, CredentialReferenceResponse, getCredentialReferenceWithResources, CredentialReferenceApiInsertSchema, createCredentialReference, CredentialReferenceApiUpdateSchema, updateCredentialReference, getCredentialReferenceById, getCredentialStoreLookupKeyFromRetrievalParams, deleteCredentialReference, DataComponentListResponse, listDataComponentsPaginated, DataComponentResponse, getDataComponent, DataComponentApiInsertSchema, createDataComponent, DataComponentApiUpdateSchema, updateDataComponent, deleteDataComponent, ExternalAgentListResponse, listExternalAgentsPaginated, ExternalAgentResponse, getExternalAgent, ExternalAgentApiInsertSchema, createExternalAgent, ExternalAgentApiUpdateSchema, updateExternalAgent, deleteExternalAgent, FunctionListResponse, listFunctions, FunctionResponse, getFunction, FunctionApiInsertSchema, upsertFunction, FunctionApiUpdateSchema, deleteFunction, FunctionToolListResponse, listFunctionTools, FunctionToolResponse, getFunctionToolById, FunctionToolApiInsertSchema, createFunctionTool, FunctionToolApiUpdateSchema, updateFunctionTool, deleteFunctionTool, MCPCatalogListResponse, fetchComposioServers, MCPTransportType, ProjectListResponse, TenantParamsSchema, listProjectsPaginated, ProjectResponse, TenantIdParamsSchema, getProject, ProjectApiInsertSchema, createProject, ProjectApiUpdateSchema, updateProject, deleteProject, ArtifactComponentArrayResponse, getArtifactComponentsForAgent, ComponentAssociationListResponse, getAgentsUsingArtifactComponent, SubAgentArtifactComponentResponse, SubAgentArtifactComponentApiInsertSchema, getSubAgentById, isArtifactComponentAssociatedWithAgent, associateArtifactComponentWithAgent, RemovedResponseSchema, removeArtifactComponentFromAgent, ExistsResponseSchema, DataComponentArrayResponse, getDataComponentsForAgent, getAgentsUsingDataComponent, SubAgentDataComponentResponse, SubAgentDataComponentApiInsertSchema, isDataComponentAssociatedWithAgent, associateDataComponentWithAgent, removeDataComponentFromAgent, SubAgentExternalAgentRelationListResponse, listSubAgentExternalAgentRelations, SubAgentExternalAgentRelationResponse, TenantProjectAgentSubAgentIdParamsSchema, getSubAgentExternalAgentRelationById, SubAgentExternalAgentRelationApiInsertSchema, createSubAgentExternalAgentRelation, SubAgentExternalAgentRelationApiUpdateSchema, updateSubAgentExternalAgentRelation, deleteSubAgentExternalAgentRelation, SubAgentRelationListResponse, SubAgentRelationQuerySchema, getAgentRelationsBySource, getSubAgentRelationsByTarget, listAgentRelations, SubAgentRelationResponse, getAgentRelationById, SubAgentRelationApiInsertSchema, validateSubAgent, createSubAgentRelation, SubAgentRelationApiUpdateSchema, updateAgentRelation, deleteSubAgentRelation, SubAgentListResponse, listSubAgentsPaginated, SubAgentResponse, SubAgentApiInsertSchema, createSubAgent, SubAgentApiUpdateSchema, updateSubAgent, deleteSubAgent, SubAgentIsDefaultError, SubAgentTeamAgentRelationListResponse, listSubAgentTeamAgentRelations, SubAgentTeamAgentRelationResponse, getSubAgentTeamAgentRelationById, SubAgentTeamAgentRelationApiInsertSchema, createSubAgentTeamAgentRelation, SubAgentTeamAgentRelationApiUpdateSchema, updateSubAgentTeamAgentRelation, deleteSubAgentTeamAgentRelation, SubAgentToolRelationListResponse, getAgentToolRelationByAgent, getAgentToolRelationByTool, listAgentToolRelations, SubAgentToolRelationResponse, getAgentToolRelationById, getAgentsForTool, SubAgentToolRelationApiInsertSchema, createAgentToolRelation, SubAgentToolRelationApiUpdateSchema, updateAgentToolRelation, deleteAgentToolRelation, ThirdPartyMCPServerResponse, fetchSingleComposioServer, McpToolListResponse, ToolStatusSchema, listTools, dbResultToMcpTool, McpToolResponse, getToolById, ToolApiInsertSchema, createTool, ToolApiUpdateSchema, updateTool, deleteTool, getPendingInvitationsByEmail, OAuthLoginQuerySchema, OAuthCallbackQuerySchema, CredentialStoreType, projectExists, signTempToken, FullProjectDefinitionResponse, FullProjectDefinitionSchema, createFullProjectServerSide, getFullProject, updateFullProjectServerSide, deleteFullProject, getUserOrganizations, addUserToOrganization, initiateMcpOAuthFlow, exchangeMcpAuthorizationCode, handleApiError, organization, getUserByEmail, member, createDefaultCredentialStores, CredentialStoreRegistry, validateAndGetApiKey } from '@inkeep/agents-core';
 import { createAuth } from '@inkeep/agents-core/auth';
 import { OpenAPIHono, createRoute, z as z$1 } from '@hono/zod-openapi';
 import { Hono } from 'hono';
@@ -56,50 +56,6 @@ ${error.message}`
   }
 };
 var env = parseEnv();
-var logger = getLogger("env-key-auth");
-var apiKeyAuth = () => createMiddleware(async (c, next) => {
-  if (env.INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET) {
-    const authHeader = c.req.header("Authorization");
-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
-      throw new HTTPException(401, {
-        message: "Missing or invalid authorization header. Expected: Bearer <api_key>"
-      });
-    }
-    const apiKey = authHeader.substring(7);
-    if (apiKey === env.INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET) {
-      logger.info({}, "Bypass secret authenticated successfully");
-      await next();
-      return;
-    }
-    throw new HTTPException(401, {
-      message: "Invalid Token"
-    });
-  }
-  await next();
-  return;
-});
-var sessionAuth = () => createMiddleware(async (c, next) => {
-  try {
-    const user = c.get("user");
-    if (!user) {
-      throw createApiError({
-        code: "unauthorized",
-        message: "Please log in to access this resource"
-      });
-    }
-    c.set("userId", user.id);
-    c.set("userEmail", user.email);
-    await next();
-  } catch (error) {
-    if (error instanceof HTTPException) {
-      throw error;
-    }
-    throw createApiError({
-      code: "unauthorized",
-      message: "Authentication failed"
-    });
-  }
-});
 
 // ../node_modules/.pnpm/@electric-sql+pglite@0.3.13/node_modules/@electric-sql/pglite/dist/chunk-3WWIVTCY.js
 var hn = {};
@@ -5164,7 +5120,58 @@ if (env.ENVIRONMENT === "test") {
 }
 var dbClient_default = dbClient;
 
-// src/middleware/tenant-access.ts
+// src/middleware/auth.ts
+var logger = getLogger("env-key-auth");
+var apiKeyAuth = () => createMiddleware(async (c, next) => {
+  const authHeader = c.req.header("Authorization");
+  if (!authHeader || !authHeader.startsWith("Bearer ")) {
+    throw new HTTPException(401, {
+      message: "Missing or invalid authorization header. Expected: Bearer <api_key>"
+    });
+  }
+  const apiKey = authHeader.substring(7);
+  if (env.INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET && apiKey === env.INKEEP_AGENTS_MANAGE_API_BYPASS_SECRET) {
+    logger.info({}, "Bypass secret authenticated successfully");
+    c.set("userId", "system");
+    c.set("userEmail", "system@internal");
+    await next();
+    return;
+  }
+  const validatedKey = await validateAndGetApiKey(apiKey, dbClient_default);
+  if (validatedKey) {
+    logger.info({ keyId: validatedKey.id }, "API key authenticated successfully");
+    c.set("userId", `apikey:${validatedKey.id}`);
+    c.set("userEmail", `apikey-${validatedKey.id}@internal`);
+    c.set("tenantId", validatedKey.tenantId);
+    await next();
+    return;
+  }
+  throw new HTTPException(401, {
+    message: "Invalid Token"
+  });
+});
+var sessionAuth = () => createMiddleware(async (c, next) => {
+  try {
+    const user = c.get("user");
+    if (!user) {
+      throw createApiError({
+        code: "unauthorized",
+        message: "Please log in to access this resource"
+      });
+    }
+    c.set("userId", user.id);
+    c.set("userEmail", user.email);
+    await next();
+  } catch (error) {
+    if (error instanceof HTTPException) {
+      throw error;
+    }
+    throw createApiError({
+      code: "unauthorized",
+      message: "Authentication failed"
+    });
+  }
+});
 var requireTenantAccess = () => createMiddleware(async (c, next) => {
   const userId = c.get("userId");
   const tenantId = c.req.param("tenantId");
@@ -5180,6 +5187,25 @@ var requireTenantAccess = () => createMiddleware(async (c, next) => {
       message: "Organization ID is required"
     });
   }
+  if (userId === "system") {
+    c.set("tenantId", tenantId);
+    c.set("tenantRole", "owner");
+    await next();
+    return;
+  }
+  if (userId.startsWith("apikey:")) {
+    const apiKeyTenantId = c.get("tenantId");
+    if (apiKeyTenantId && apiKeyTenantId !== tenantId) {
+      throw createApiError({
+        code: "forbidden",
+        message: "API key does not have access to this organization"
+      });
+    }
+    c.set("tenantId", tenantId);
+    c.set("tenantRole", "owner");
+    await next();
+    return;
+  }
   try {
     const userOrganizations = await getUserOrganizations(dbClient_default)(userId);
     const organizationAccess = userOrganizations.find((org) => org.organizationId === tenantId);
@@ -5353,6 +5379,16 @@ function setupOpenAPIRoutes(app29) {
     })
   );
 }
+function formatPermissionsForDisplay(permissions) {
+  const formatted = [];
+  for (const [resource, actions] of Object.entries(permissions)) {
+    const actionList = Array.isArray(actions) ? actions : [actions];
+    for (const action of actionList) {
+      formatted.push(`${resource}:${action}`);
+    }
+  }
+  return formatted;
+}
 var requirePermission = (permissions) => createMiddleware(async (c, next) => {
   const isTestEnvironment = process.env.ENVIRONMENT === "test";
   const auth = c.get("auth");
@@ -5362,10 +5398,24 @@ var requirePermission = (permissions) => createMiddleware(async (c, next) => {
   }
   const userId = c.get("userId");
   const tenantId = c.get("tenantId");
+  const tenantRole = c.get("tenantRole");
+  const requiredPermissions = formatPermissionsForDisplay(permissions);
+  if (userId === "system" || userId?.startsWith("apikey:")) {
+    await next();
+    return;
+  }
   if (!userId || !tenantId) {
     throw createApiError({
       code: "unauthorized",
-      message: "User or organization not found"
+      message: "User or organization context not found. Ensure you are authenticated and belong to an organization.",
+      instance: c.req.path,
+      extensions: {
+        requiredPermissions,
+        context: {
+          hasUserId: !!userId,
+          hasTenantId: !!tenantId
+        }
+      }
     });
   }
   try {
@@ -5379,7 +5429,16 @@ var requirePermission = (permissions) => createMiddleware(async (c, next) => {
     if (!result || !result.success) {
       throw createApiError({
         code: "forbidden",
-        message: "You do not have the required permissions to perform this action"
+        message: `Permission denied. Required: ${requiredPermissions.join(", ")}`,
+        instance: c.req.path,
+        extensions: {
+          requiredPermissions,
+          context: {
+            userId,
+            organizationId: tenantId,
+            currentRole: tenantRole || "unknown"
+          }
+        }
       });
     }
     await next();
@@ -5387,9 +5446,15 @@ var requirePermission = (permissions) => createMiddleware(async (c, next) => {
     if (error instanceof HTTPException) {
       throw error;
     }
+    const errorMessage = error instanceof Error ? error.message : "Unknown error";
     throw createApiError({
       code: "internal_server_error",
-      message: "Failed to verify permissions"
+      message: "Failed to verify permissions",
+      instance: c.req.path,
+      extensions: {
+        requiredPermissions,
+        internalError: errorMessage
+      }
     });
   }
 });
@@ -12075,7 +12140,16 @@ function createManagementHono(serverConfig, credentialStores, auth) {
     return sessionAuth()(c, next);
   });
   const isTestEnv = process.env.ENVIRONMENT === "test";
-  if (!env.DISABLE_AUTH && !isTestEnv) {
+  if (env.DISABLE_AUTH || isTestEnv) {
+    app29.use("/tenants/:tenantId/*", async (c, next) => {
+      const tenantId = c.req.param("tenantId");
+      if (tenantId) {
+        c.set("tenantId", tenantId);
+        c.set("userId", "anonymous");
+      }
+      await next();
+    });
+  } else {
     app29.use("/tenants/:tenantId/*", requireTenantAccess());
   }
   app29.route("/api/users/:userId/organizations", userOrganizations_default);

package/dist/factory.js

@@ -1 +1 @@
-export { createAuth0Provider, createManagementApp, createManagementHono, createOIDCProvider, initializeDefaultUser } from './chunk-QKQOZRHG.js';
+export { createAuth0Provider, createManagementApp, createManagementHono, createOIDCProvider, initializeDefaultUser } from './chunk-T4UJH26R.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-import { createAuth0Provider, createManagementHono, env, initializeDefaultUser, dbClient_default } from './chunk-QKQOZRHG.js';
-export { createAuth0Provider, createManagementApp, createManagementHono, createOIDCProvider, initializeDefaultUser } from './chunk-QKQOZRHG.js';
+import { createAuth0Provider, createManagementHono, env, initializeDefaultUser, dbClient_default } from './chunk-T4UJH26R.js';
+export { createAuth0Provider, createManagementApp, createManagementHono, createOIDCProvider, initializeDefaultUser } from './chunk-T4UJH26R.js';
 import { createDefaultCredentialStores, CredentialStoreRegistry } from '@inkeep/agents-core';
 import { createAuth } from '@inkeep/agents-core/auth';
 export { Hono } from 'hono';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inkeep/agents-manage-api",
-  "version": "0.0.0-dev-20251125061854",
+  "version": "0.0.0-dev-20251125083010",
   "description": "Agents Manage API for Inkeep Agent Framework - handles CRUD operations and OAuth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -34,8 +34,8 @@
     "openid-client": "^6.6.4",
     "pino": "^9.7.0",
     "zod": "^4.1.11",
-    "@inkeep/agents-core": "^0.0.0-dev-20251125061854",
-    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20251125061854"
+    "@inkeep/agents-core": "^0.0.0-dev-20251125083010",
+    "@inkeep/agents-manage-mcp": "^0.0.0-dev-20251125083010"
   },
   "optionalDependencies": {
     "keytar": "^7.9.0"