@inkeep/agents-run-api 0.0.0-dev-20260113172432 → 0.0.0-dev-20260115183047

package/dist/env.d.ts

@@ -13,8 +13,10 @@ declare const envSchema: z.ZodObject<{
     test: "test";
     pentest: "pentest";
   }>>>;
-  DATABASE_URL: z.ZodOptional<z.ZodString>;
   INKEEP_AGENTS_RUN_API_URL: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+  INKEEP_AGENTS_MANAGE_API_URL: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+  INKEEP_AGENTS_EVAL_API_URL: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+  INKEEP_AGENTS_RUN_DATABASE_URL: z.ZodOptional<z.ZodString>;
   AGENTS_MANAGE_UI_URL: z.ZodDefault<z.ZodOptional<z.ZodString>>;
   LOG_LEVEL: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
     trace: "trace";
@@ -37,6 +39,8 @@ declare const envSchema: z.ZodObject<{
 declare const env: {
   ENVIRONMENT: "development" | "production" | "test" | "pentest";
   INKEEP_AGENTS_RUN_API_URL: string;
+  INKEEP_AGENTS_MANAGE_API_URL: string;
+  INKEEP_AGENTS_EVAL_API_URL: string;
   AGENTS_MANAGE_UI_URL: string;
   LOG_LEVEL: "trace" | "debug" | "info" | "warn" | "error";
   NANGO_SERVER_URL: string;
@@ -44,7 +48,7 @@ declare const env: {
   OTEL_BSP_SCHEDULE_DELAY: number;
   OTEL_BSP_MAX_EXPORT_BATCH_SIZE: number;
   NODE_ENV?: "development" | "production" | "test" | undefined;
-  DATABASE_URL?: string | undefined;
+  INKEEP_AGENTS_RUN_DATABASE_URL?: string | undefined;
   NANGO_SECRET_KEY?: string | undefined;
   OPENAI_API_KEY?: string | undefined;
   GOOGLE_GENERATIVE_AI_API_KEY?: string | undefined;

package/dist/env.js

@@ -15,8 +15,10 @@ const envSchema = z.object({
 		"pentest",
 		"test"
 	]).optional().default("development"),
-	DATABASE_URL: z.string().optional(),
 	INKEEP_AGENTS_RUN_API_URL: z.string().optional().default("http://localhost:3003"),
+	INKEEP_AGENTS_MANAGE_API_URL: z.string().optional().default("http://localhost:3002"),
+	INKEEP_AGENTS_EVAL_API_URL: z.string().optional().default("http://localhost:3005"),
+	INKEEP_AGENTS_RUN_DATABASE_URL: z.string().optional(),
 	AGENTS_MANAGE_UI_URL: z.string().optional().default("http://localhost:3000"),
 	LOG_LEVEL: z.enum([
 		"trace",

package/dist/handlers/executionHandler.d.ts

@@ -1,15 +1,16 @@
 import { StreamHelper } from "../utils/stream-helpers.js";
-import { ExecutionContext } from "@inkeep/agents-core";
+import { FullExecutionContext } from "@inkeep/agents-core";
 
 //#region src/handlers/executionHandler.d.ts
 interface ExecutionHandlerParams {
-  executionContext: ExecutionContext;
+  executionContext: FullExecutionContext;
   conversationId: string;
   userMessage: string;
   initialAgentId: string;
   requestId: string;
   sseHelper: StreamHelper;
   emitOperations?: boolean;
+  datasetRunId?: string;
   /** Headers to forward to MCP servers (e.g., x-forwarded-cookie for auth) */
   forwardedHeaders?: Record<string, string>;
 }

package/dist/handlers/executionHandler.js

@@ -1,6 +1,7 @@
-import { getLogger } from "../logger.js";
+import { getLogger as getLogger$1 } from "../logger.js";
 import { flushBatchProcessor } from "../instrumentation.js";
 import dbClient_default from "../data/db/dbClient.js";
+import { getUserIdFromContext } from "../types/execution-context.js";
 import { AGENT_EXECUTION_MAX_CONSECUTIVE_ERRORS } from "../constants/execution-limits/index.js";
 import { tracer } from "../utils/tracer.js";
 import { registerStreamHelper, unregisterStreamHelper } from "../utils/stream-registry.js";
@@ -10,11 +11,12 @@ import { agentInitializingOp, completionOp, errorOp } from "../utils/agent-opera
 import { A2AClient } from "../a2a/client.js";
 import { extractTransferData, isTransferTask } from "../a2a/types.js";
 import { executeTransfer } from "../a2a/transfer.js";
+import { triggerConversationEvaluationHttp } from "../services/evaluationHttpClient.js";
 import { BufferingStreamHelper } from "../utils/stream-helpers.js";
-import { AGENT_EXECUTION_TRANSFER_COUNT_DEFAULT, createMessage, createTask, generateId, getActiveAgentForConversation, getAgentWithDefaultSubAgent, getFullAgent, getTask, setSpanWithError, updateTask } from "@inkeep/agents-core";
+import { AGENT_EXECUTION_TRANSFER_COUNT_DEFAULT, createMessage, createTask, generateId, getActiveAgentForConversation, getTask, setSpanWithError, updateTask } from "@inkeep/agents-core";
 
 //#region src/handlers/executionHandler.ts
-const logger = getLogger("ExecutionHandler");
+const logger = getLogger$1("ExecutionHandler");
 var ExecutionHandler = class {
 	MAX_ERRORS = AGENT_EXECUTION_MAX_CONSECUTIVE_ERRORS;
 	/**
@@ -33,9 +35,9 @@ var ExecutionHandler = class {
 	*/
 	async execute(params) {
 		const { executionContext, conversationId, userMessage, initialAgentId, requestId, sseHelper, emitOperations, forwardedHeaders } = params;
-		const { tenantId, projectId, agentId, apiKey, baseUrl } = executionContext;
+		const { tenantId, projectId, project, agentId, apiKey, baseUrl, resolvedRef } = executionContext;
 		registerStreamHelper(requestId, sseHelper);
-		agentSessionManager.createSession(requestId, agentId, tenantId, projectId, conversationId);
+		agentSessionManager.createSession(requestId, executionContext, conversationId);
 		if (emitOperations) agentSessionManager.enableEmitOperations(requestId);
 		logger.info({
 			sessionId: requestId,
@@ -43,21 +45,12 @@ var ExecutionHandler = class {
 			conversationId,
 			emitOperations
 		}, "Created AgentSession for message execution");
-		let agentConfig = null;
+		const agentConfig = null;
 		try {
-			agentConfig = await getFullAgent(dbClient_default)({ scopes: {
-				tenantId,
-				projectId,
-				agentId
-			} });
-			if (agentConfig?.statusUpdates && agentConfig.statusUpdates.enabled !== false) try {
-				const agentWithDefault = await getAgentWithDefaultSubAgent(dbClient_default)({ scopes: {
-					tenantId,
-					projectId,
-					agentId
-				} });
-				if (agentWithDefault?.defaultSubAgent) {
-					const resolvedModels = await resolveModelConfig(agentId, agentWithDefault.defaultSubAgent);
+			const agent = project.agents[agentId];
+			if (agent?.statusUpdates && agent.statusUpdates.enabled !== false) try {
+				if (agent?.defaultSubAgentId) {
+					const resolvedModels = await resolveModelConfig(executionContext, agent.subAgents[agent.defaultSubAgentId]);
 					agentSessionManager.initializeStatusUpdates(requestId, agentConfig.statusUpdates, resolvedModels.summarizer, resolvedModels.base);
 				} else agentSessionManager.initializeStatusUpdates(requestId, agentConfig.statusUpdates, agentConfig.models?.summarizer);
 			} catch (modelError) {
@@ -96,6 +89,7 @@ var ExecutionHandler = class {
 					subAgentId: currentAgentId,
 					contextId: conversationId,
 					status: "pending",
+					ref: resolvedRef,
 					metadata: {
 						conversation_id: conversationId,
 						message_id: requestId,
@@ -205,7 +199,10 @@ var ExecutionHandler = class {
 					logger.error({
 						currentAgentId,
 						iterations,
-						errorCount
+						errorCount,
+						hasError: !!messageResponse?.error,
+						errorDetails: messageResponse?.error,
+						fullResponse: messageResponse
 					}, `No response from agent ${currentAgentId} on iteration ${iterations} (error ${errorCount}/${this.MAX_ERRORS})`);
 					if (errorCount >= this.MAX_ERRORS) {
 						const errorMessage$1 = `Maximum error limit (${this.MAX_ERRORS}) reached`;
@@ -272,7 +269,9 @@ var ExecutionHandler = class {
 						projectId,
 						tenantId,
 						threadId: conversationId,
-						targetSubAgentId
+						agentId,
+						targetSubAgentId,
+						ref: resolvedRef
 					});
 					if (success) {
 						fromSubAgentId = currentAgentId;
@@ -306,7 +305,7 @@ var ExecutionHandler = class {
 							span.setAttributes({
 								"ai.response.content": textContent || "No response content",
 								"ai.response.timestamp": (/* @__PURE__ */ new Date()).toISOString(),
-								"subAgent.name": agentConfig?.subAgents[currentAgentId]?.name,
+								"subAgent.name": project.agents[agentId]?.subAgents[currentAgentId]?.name,
 								"subAgent.id": currentAgentId
 							});
 							await createMessage(dbClient_default)({
@@ -356,6 +355,18 @@ var ExecutionHandler = class {
 							let response;
 							if (sseHelper instanceof BufferingStreamHelper) response = sseHelper.getCapturedResponse().text || "No response content";
 							logger.info({}, "ExecutionHandler returning success");
+							if (!params.datasetRunId) triggerConversationEvaluationHttp({
+								tenantId,
+								projectId,
+								conversationId
+							}).catch((error) => {
+								logger.error({
+									error,
+									conversationId,
+									tenantId,
+									projectId
+								}, "Failed to trigger conversation evaluation (non-blocking)");
+							});
 							return {
 								success: true,
 								iterations,
@@ -396,6 +407,19 @@ var ExecutionHandler = class {
 					});
 					await agentSessionManager.endSession(requestId);
 					unregisterStreamHelper(requestId);
+					if (!params.datasetRunId) triggerConversationEvaluationHttp({
+						tenantId,
+						projectId,
+						conversationId,
+						userId: getUserIdFromContext(executionContext)
+					}).catch((error) => {
+						logger.error({
+							error,
+							conversationId,
+							tenantId,
+							projectId
+						}, "Failed to trigger conversation evaluation (non-blocking)");
+					});
 					return {
 						success: false,
 						error: errorMessage$1,

package/dist/index.d.ts

@@ -3,14 +3,14 @@ import { createExecutionHono } from "./create-app.js";
 import "./env.js";
 import { CredentialStore, ServerConfig } from "@inkeep/agents-core";
 import { Hono } from "hono";
-import * as hono_types0 from "hono/types";
+import * as hono_types1 from "hono/types";
 
 //#region src/index.d.ts
-declare const app: Hono<hono_types0.BlankEnv, hono_types0.BlankSchema, "/">;
+declare const app: Hono<hono_types1.BlankEnv, hono_types1.BlankSchema, "/">;
 declare function createExecutionApp(config?: {
   serverConfig?: ServerConfig;
   credentialStores?: CredentialStore[];
   sandboxConfig?: SandboxConfig;
-}): Hono<hono_types0.BlankEnv, hono_types0.BlankSchema, "/">;
+}): Hono<hono_types1.BlankEnv, hono_types1.BlankSchema, "/">;
 //#endregion
 export { Hono, type NativeSandboxConfig, type SandboxConfig, type VercelSandboxConfig, createExecutionApp, createExecutionHono, app as default };

package/dist/middleware/api-key-auth.d.ts

@@ -1,26 +1,20 @@
-import { ExecutionContext } from "@inkeep/agents-core";
+import { BaseExecutionContext } from "@inkeep/agents-core";
 import * as hono0 from "hono";
 
 //#region src/middleware/api-key-auth.d.ts
 declare const apiKeyAuth: () => hono0.MiddlewareHandler<{
   Variables: {
-    executionContext: ExecutionContext;
+    executionContext: BaseExecutionContext;
   };
 }, string, {}, Response>;
-declare const extractContextFromApiKey: (apiKey: string, baseUrl?: string) => Promise<ExecutionContext>;
-/**
- * Extract execution context from a team agent JWT token
- * Team agent tokens are used for intra-tenant agent delegation
- */
-declare const extractContextFromTeamAgentToken: (token: string, baseUrl?: string, expectedSubAgentId?: string) => Promise<ExecutionContext>;
 /**
  * Helper middleware for endpoints that optionally support API key authentication
  * If no auth header is present, it continues without setting the executionContext
  */
 declare const optionalAuth: () => hono0.MiddlewareHandler<{
   Variables: {
-    executionContext?: ExecutionContext;
+    executionContext?: BaseExecutionContext;
   };
 }, string, {}, Response>;
 //#endregion
-export { apiKeyAuth, extractContextFromApiKey, extractContextFromTeamAgentToken, optionalAuth };
+export { apiKeyAuth, optionalAuth };

package/dist/middleware/api-key-auth.js

@@ -1,198 +1,105 @@
 import { env } from "../env.js";
-import { getLogger } from "../logger.js";
+import { getLogger as getLogger$1 } from "../logger.js";
 import dbClient_default from "../data/db/dbClient.js";
-import { createExecutionContext } from "../types/execution-context.js";
-import { getAgentById, validateAndGetApiKey, validateTargetAgent, verifyServiceToken, verifyTempToken } from "@inkeep/agents-core";
+import { createBaseExecutionContext } from "../types/execution-context.js";
+import { validateAndGetApiKey, validateTargetAgent, verifyServiceToken, verifyTempToken } from "@inkeep/agents-core";
 import { HTTPException } from "hono/http-exception";
 import { createMiddleware } from "hono/factory";
 
 //#region src/middleware/api-key-auth.ts
-const logger = getLogger("env-key-auth");
+const logger = getLogger$1("env-key-auth");
+/**
+* Extract common request data from the Hono context
+*/
+function extractRequestData(c) {
+	const authHeader = c.req.header("Authorization");
+	const tenantId = c.req.header("x-inkeep-tenant-id");
+	const projectId = c.req.header("x-inkeep-project-id");
+	const agentId = c.req.header("x-inkeep-agent-id");
+	const subAgentId = c.req.header("x-inkeep-sub-agent-id");
+	const proto = c.req.header("x-forwarded-proto")?.split(",")[0].trim();
+	const host = c.req.header("x-forwarded-host")?.split(",")[0].trim() ?? c.req.header("host");
+	const reqUrl = new URL(c.req.url);
+	const ref = c.req.query("ref");
+	const baseUrl = proto && host ? `${proto}://${host}` : host ? `${reqUrl.protocol}//${host}` : `${reqUrl.origin}`;
+	return {
+		authHeader,
+		apiKey: authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : void 0,
+		tenantId,
+		projectId,
+		agentId,
+		subAgentId,
+		ref,
+		baseUrl
+	};
+}
+/**
+* Build the final execution context from auth result and request data
+*/
+function buildExecutionContext(authResult, reqData) {
+	return createBaseExecutionContext({
+		apiKey: authResult.apiKey,
+		tenantId: authResult.tenantId,
+		projectId: authResult.projectId,
+		agentId: authResult.agentId,
+		apiKeyId: authResult.apiKeyId,
+		baseUrl: reqData.baseUrl,
+		subAgentId: reqData.subAgentId,
+		ref: reqData.ref,
+		metadata: authResult.metadata
+	});
+}
 /**
 * Attempts to authenticate using a JWT temporary token
-* Returns execution context if successful, null if token is invalid or not a JWT
 */
-async function tryAuthenticateWithTempJwt(apiKey, baseUrl, subAgentId) {
+async function tryTempJwtAuth(apiKey) {
 	if (!apiKey.startsWith("eyJ") || !env.INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY) return null;
 	try {
 		const payload = await verifyTempToken(Buffer.from(env.INKEEP_AGENTS_TEMP_JWT_PUBLIC_KEY, "base64").toString("utf-8"), apiKey);
 		logger.info({}, "JWT temp token authenticated successfully");
-		return createExecutionContext({
+		return {
 			apiKey,
 			tenantId: payload.tenantId,
 			projectId: payload.projectId,
 			agentId: payload.agentId,
 			apiKeyId: "temp-jwt",
-			baseUrl,
-			subAgentId,
 			metadata: { initiatedBy: payload.initiatedBy }
-		});
+		};
 	} catch (error) {
 		logger.debug({ error }, "JWT verification failed");
 		return null;
 	}
 }
-const apiKeyAuth = () => createMiddleware(async (c, next) => {
-	if (c.req.method === "OPTIONS") {
-		await next();
-		return;
-	}
-	const authHeader = c.req.header("Authorization");
-	const tenantId = c.req.header("x-inkeep-tenant-id");
-	const projectId = c.req.header("x-inkeep-project-id");
-	const agentId = c.req.header("x-inkeep-agent-id");
-	const subAgentId = c.req.header("x-inkeep-sub-agent-id");
-	const proto = c.req.header("x-forwarded-proto")?.split(",")[0].trim();
-	const host = c.req.header("x-forwarded-host")?.split(",")[0].trim() ?? c.req.header("host");
-	const reqUrl = new URL(c.req.url);
-	const baseUrl = proto && host ? `${proto}://${host}` : host ? `${reqUrl.protocol}//${host}` : `${reqUrl.origin}`;
-	if (process.env.ENVIRONMENT === "development" || process.env.ENVIRONMENT === "test") {
-		logger.info({}, "development environment");
-		let executionContext;
-		if (authHeader?.startsWith("Bearer ")) {
-			const apiKey$1 = authHeader.substring(7);
-			const jwtContext$1 = await tryAuthenticateWithTempJwt(apiKey$1, baseUrl, subAgentId);
-			if (jwtContext$1) {
-				c.set("executionContext", jwtContext$1);
-				await next();
-				return;
-			}
-			try {
-				executionContext = await extractContextFromApiKey(apiKey$1, baseUrl);
-				if (subAgentId) executionContext.subAgentId = subAgentId;
-				c.set("executionContext", executionContext);
-			} catch {
-				try {
-					executionContext = await extractContextFromTeamAgentToken(apiKey$1, baseUrl, subAgentId);
-					c.set("executionContext", executionContext);
-				} catch {
-					executionContext = createExecutionContext({
-						apiKey: "development",
-						tenantId: tenantId || "test-tenant",
-						projectId: projectId || "test-project",
-						agentId: agentId || "test-agent",
-						apiKeyId: "test-key",
-						baseUrl,
-						subAgentId
-					});
-					c.set("executionContext", executionContext);
-					logger.info({}, "Development/test environment - fallback to default context due to invalid API key");
-				}
-			}
-		} else {
-			executionContext = createExecutionContext({
-				apiKey: "development",
-				tenantId: tenantId || "test-tenant",
-				projectId: projectId || "test-project",
-				agentId: agentId || "test-agent",
-				apiKeyId: "test-key",
-				baseUrl,
-				subAgentId
-			});
-			c.set("executionContext", executionContext);
-			logger.info({}, "Development/test environment - no API key provided, using default context");
-		}
-		await next();
-		return;
-	}
-	if (!authHeader || !authHeader.startsWith("Bearer ")) throw new HTTPException(401, { message: "Missing or invalid authorization header. Expected: Bearer <api_key>" });
-	const apiKey = authHeader.substring(7);
-	const jwtContext = await tryAuthenticateWithTempJwt(apiKey, baseUrl, subAgentId);
-	if (jwtContext) {
-		c.set("executionContext", jwtContext);
-		await next();
-		return;
-	}
-	if (env.INKEEP_AGENTS_RUN_API_BYPASS_SECRET) {
-		if (apiKey === env.INKEEP_AGENTS_RUN_API_BYPASS_SECRET) {
-			if (!tenantId || !projectId || !agentId) throw new HTTPException(401, { message: "Missing or invalid tenant, project, or agent ID" });
-			const executionContext = createExecutionContext({
-				apiKey,
-				tenantId,
-				projectId,
-				agentId,
-				apiKeyId: "bypass",
-				baseUrl,
-				subAgentId
-			});
-			c.set("executionContext", executionContext);
-			logger.info({}, "Bypass secret authenticated successfully");
-			await next();
-			return;
-		}
-		if (apiKey) {
-			try {
-				const executionContext = await extractContextFromApiKey(apiKey, baseUrl);
-				if (subAgentId) executionContext.subAgentId = subAgentId;
-				c.set("executionContext", executionContext);
-				logger.info({}, "API key authenticated successfully");
-			} catch {
-				const executionContext = await extractContextFromTeamAgentToken(apiKey, baseUrl, subAgentId);
-				c.set("executionContext", executionContext);
-			}
-			await next();
-			return;
-		}
-		throw new HTTPException(401, { message: "Invalid Token" });
-	}
-	if (!apiKey || apiKey.length < 16) throw new HTTPException(401, { message: "Invalid API key format" });
-	try {
-		const executionContext = await extractContextFromApiKey(apiKey, baseUrl);
-		if (subAgentId) executionContext.subAgentId = subAgentId;
-		c.set("executionContext", executionContext);
-		logger.debug({
-			tenantId: executionContext.tenantId,
-			projectId: executionContext.projectId,
-			agentId: executionContext.agentId,
-			subAgentId: executionContext.subAgentId
-		}, "API key authenticated successfully");
-		await next();
-	} catch {
-		try {
-			const executionContext = await extractContextFromTeamAgentToken(apiKey, baseUrl, subAgentId);
-			c.set("executionContext", executionContext);
-			await next();
-		} catch (error) {
-			if (error instanceof HTTPException) throw error;
-			logger.error({ error }, "API key authentication error");
-			throw new HTTPException(500, { message: "Authentication failed" });
-		}
-	}
-});
-const extractContextFromApiKey = async (apiKey, baseUrl) => {
+/**
+* Authenticate using a regular API key
+*/
+async function tryApiKeyAuth(apiKey) {
 	const apiKeyRecord = await validateAndGetApiKey(apiKey, dbClient_default);
-	if (!apiKeyRecord) throw new HTTPException(401, { message: "Invalid or expired API key" });
-	const agent = await getAgentById(dbClient_default)({ scopes: {
-		tenantId: apiKeyRecord.tenantId,
-		projectId: apiKeyRecord.projectId,
-		agentId: apiKeyRecord.agentId
-	} });
-	if (!agent) throw new HTTPException(401, { message: "Invalid or expired API key" });
+	if (!apiKeyRecord) return null;
 	logger.debug({
 		tenantId: apiKeyRecord.tenantId,
 		projectId: apiKeyRecord.projectId,
-		agentId: apiKeyRecord.agentId,
-		subAgentId: agent.defaultSubAgentId || void 0
+		agentId: apiKeyRecord.agentId
 	}, "API key authenticated successfully");
-	return createExecutionContext({
+	return {
 		apiKey,
 		tenantId: apiKeyRecord.tenantId,
 		projectId: apiKeyRecord.projectId,
 		agentId: apiKeyRecord.agentId,
-		apiKeyId: apiKeyRecord.id,
-		baseUrl,
-		subAgentId: agent.defaultSubAgentId || void 0
-	});
-};
+		apiKeyId: apiKeyRecord.id
+	};
+}
 /**
-* Extract execution context from a team agent JWT token
-* Team agent tokens are used for intra-tenant agent delegation
+* Authenticate using a team agent JWT token (for intra-tenant delegation)
 */
-const extractContextFromTeamAgentToken = async (token, baseUrl, expectedSubAgentId) => {
+async function tryTeamAgentAuth(token, expectedSubAgentId) {
 	const result = await verifyServiceToken(token);
 	if (!result.valid || !result.payload) {
 		logger.warn({ error: result.error }, "Invalid team agent JWT token");
-		throw new HTTPException(401, { message: `Invalid team agent token: ${result.error || "Unknown error"}` });
+		return {
+			authResult: null,
+			failureMessage: `Invalid team agent token: ${result.error || "Invalid token"}`
+		};
 	}
 	const payload = result.payload;
 	if (expectedSubAgentId && !validateTargetAgent(payload, expectedSubAgentId)) {
@@ -209,20 +116,114 @@ const extractContextFromTeamAgentToken = async (token, baseUrl, expectedSubAgent
 		tenantId: payload.tenantId,
 		projectId: payload.projectId
 	}, "Team agent JWT token authenticated successfully");
-	return createExecutionContext({
+	return { authResult: {
 		apiKey: "team-agent-jwt",
 		tenantId: payload.tenantId,
 		projectId: payload.projectId,
 		agentId: payload.aud,
 		apiKeyId: "team-agent-token",
-		baseUrl,
-		subAgentId: void 0,
 		metadata: {
 			teamDelegation: true,
 			originAgentId: payload.sub
 		}
-	});
-};
+	} };
+}
+/**
+* Authenticate using bypass secret (production mode bypass)
+*/
+function tryBypassAuth(apiKey, reqData) {
+	if (!env.INKEEP_AGENTS_RUN_API_BYPASS_SECRET) return null;
+	if (apiKey !== env.INKEEP_AGENTS_RUN_API_BYPASS_SECRET) return null;
+	if (!reqData.tenantId || !reqData.projectId || !reqData.agentId) throw new HTTPException(401, { message: "Missing or invalid tenant, project, or agent ID" });
+	logger.info({}, "Bypass secret authenticated successfully");
+	return {
+		apiKey,
+		tenantId: reqData.tenantId,
+		projectId: reqData.projectId,
+		agentId: reqData.agentId,
+		apiKeyId: "bypass"
+	};
+}
+/**
+* Create default development context
+*/
+function createDevContext(reqData) {
+	const result = {
+		apiKey: "development",
+		tenantId: reqData.tenantId || "test-tenant",
+		projectId: reqData.projectId || "test-project",
+		agentId: reqData.agentId || "test-agent",
+		apiKeyId: "test-key"
+	};
+	if (!reqData.tenantId || !reqData.projectId) logger.warn({
+		hasTenantId: !!reqData.tenantId,
+		hasProjectId: !!reqData.projectId,
+		hasApiKey: !!reqData.apiKey,
+		apiKeyPrefix: reqData.apiKey?.substring(0, 10),
+		resultTenantId: result.tenantId,
+		resultProjectId: result.projectId
+	}, "createDevContext: Using fallback test values due to missing tenant/project in request");
+	return result;
+}
+/**
+* Try all auth strategies in order, returning the first successful result
+*/
+async function authenticateRequest(reqData) {
+	const { apiKey, subAgentId } = reqData;
+	if (!apiKey) return { authResult: null };
+	const jwtResult = await tryTempJwtAuth(apiKey);
+	if (jwtResult) return { authResult: jwtResult };
+	const bypassResult = tryBypassAuth(apiKey, reqData);
+	if (bypassResult) return { authResult: bypassResult };
+	const apiKeyResult = await tryApiKeyAuth(apiKey);
+	if (apiKeyResult) return { authResult: apiKeyResult };
+	const teamAttempt = await tryTeamAgentAuth(apiKey, subAgentId);
+	if (teamAttempt.authResult) return { authResult: teamAttempt.authResult };
+	return {
+		authResult: null,
+		failureMessage: teamAttempt.failureMessage
+	};
+}
+const apiKeyAuth = () => createMiddleware(async (c, next) => {
+	if (c.req.method === "OPTIONS") {
+		await next();
+		return;
+	}
+	const reqData = extractRequestData(c);
+	if (process.env.ENVIRONMENT === "development" || process.env.ENVIRONMENT === "test") {
+		logger.info({}, "development environment");
+		const attempt$1 = await authenticateRequest(reqData);
+		if (attempt$1.authResult) c.set("executionContext", buildExecutionContext(attempt$1.authResult, reqData));
+		else {
+			logger.info({}, reqData.apiKey ? "Development/test environment - fallback to default context due to invalid API key" : "Development/test environment - no API key provided, using default context");
+			c.set("executionContext", buildExecutionContext(createDevContext(reqData), reqData));
+		}
+		await next();
+		return;
+	}
+	if (!reqData.authHeader || !reqData.authHeader.startsWith("Bearer ")) throw new HTTPException(401, { message: "Missing or invalid authorization header. Expected: Bearer <api_key>" });
+	if (!reqData.apiKey || reqData.apiKey.length < 16) throw new HTTPException(401, { message: "Invalid API key format" });
+	let attempt = { authResult: null };
+	try {
+		attempt = await authenticateRequest(reqData);
+	} catch (error) {
+		if (error instanceof HTTPException) throw error;
+		logger.error({ error }, "Authentication failed");
+		throw new HTTPException(500, { message: "Authentication failed" });
+	}
+	if (!attempt.authResult) {
+		logger.error({}, "API key authentication error - no valid auth method found");
+		throw new HTTPException(401, { message: attempt.failureMessage || "Invalid Token" });
+	}
+	logger.debug({
+		tenantId: attempt.authResult.tenantId,
+		projectId: attempt.authResult.projectId,
+		agentId: attempt.authResult.agentId,
+		subAgentId: reqData.subAgentId
+	}, "API key authenticated successfully");
+	c.set("executionContext", buildExecutionContext(attempt.authResult, reqData));
+	await next();
+});
 /**
 * Helper middleware for endpoints that optionally support API key authentication
 * If no auth header is present, it continues without setting the executionContext
@@ -237,4 +238,4 @@ const optionalAuth = () => createMiddleware(async (c, next) => {
 });
 
 //#endregion
-export { apiKeyAuth, extractContextFromApiKey, extractContextFromTeamAgentToken, optionalAuth };
+export { apiKeyAuth, optionalAuth };

package/dist/middleware/index.d.ts

@@ -1,2 +1,3 @@
-import { apiKeyAuth, extractContextFromApiKey, extractContextFromTeamAgentToken, optionalAuth } from "./api-key-auth.js";
-export { apiKeyAuth, extractContextFromApiKey, extractContextFromTeamAgentToken, optionalAuth };
+import { apiKeyAuth, optionalAuth } from "./api-key-auth.js";
+import { projectConfigMiddleware } from "./projectConfig.js";
+export { apiKeyAuth, optionalAuth, projectConfigMiddleware };

package/dist/middleware/index.js

@@ -1,3 +1,4 @@
-import { apiKeyAuth, extractContextFromApiKey, extractContextFromTeamAgentToken, optionalAuth } from "./api-key-auth.js";
+import { apiKeyAuth, optionalAuth } from "./api-key-auth.js";
+import { projectConfigMiddleware } from "./projectConfig.js";
 
-export { apiKeyAuth, extractContextFromApiKey, extractContextFromTeamAgentToken, optionalAuth };
+export { apiKeyAuth, optionalAuth, projectConfigMiddleware };

package/dist/middleware/projectConfig.d.ts

@@ -0,0 +1,19 @@
+import { FullExecutionContext } from "@inkeep/agents-core";
+import * as hono0 from "hono";
+
+//#region src/middleware/projectConfig.d.ts
+
+/**
+ * Middleware that fetches the full project definition from the Management API
+ * and adds it to the Hono context for use in route handlers.
+ *
+ * This middleware should be applied after authentication middleware since it
+ * requires the execution context to be set.
+ */
+declare const projectConfigMiddleware: hono0.MiddlewareHandler<{
+  Variables: {
+    executionContext: FullExecutionContext;
+  };
+}, string, {}, Response>;
+//#endregion
+export { projectConfigMiddleware };