@standardagents/builder 0.11.0-next.5d2e71b → 0.11.0-next.730b472

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { AgentPluginOptions, agentbuilder } from './plugin.js';
 import { DurableObjectStorage } from '@cloudflare/workers-types';
 import { ZodObject, ZodRawShape } from 'zod';
-import { ToolResult as ToolResult$1, HookSignatures, ControllerContext, Controller, ModelDefinition as ModelDefinition$1, ToolArgs, PromptTextPart, SubpromptConfig as SubpromptConfig$2, ReasoningConfig, SideConfig as SideConfig$1 } from '@standardagents/spec';
+import { ToolResult as ToolResult$1, HookSignatures, AgentDefinition as AgentDefinition$1, ControllerContext, Controller, ModelDefinition as ModelDefinition$1, ToolArgs, PromptTextPart, SubpromptConfig as SubpromptConfig$2, ReasoningConfig, SideConfig as SideConfig$1 } from '@standardagents/spec';
 export { AgentType, HookSignatures, ImageContent, ModelCapabilities, ModelProvider, PromptInput, PromptTextPart, ReasoningConfig, StructuredPrompt, TextContent, Tool, ToolArgs, ToolArgsNode, ToolArgsRawShape, ToolContent, defineAgent, defineHook, defineModel, definePrompt, defineThreadEndpoint, defineTool } from '@standardagents/spec';
 import { DurableObject } from 'cloudflare:workers';
 import 'vite';
@@ -785,20 +785,6 @@ interface LogEntry {
     created_at: number;
     request_body: string | null;
 }
-/**
- * Agent definition returned from loadAgent()
- */
-interface AgentDefinition$1 {
-    name: string;
-    title?: string;
-    type?: string;
-    description?: string;
-    icon?: string;
-    defaultPrompt?: string;
-    defaultModel?: string;
-    tools?: string[];
-    [key: string]: unknown;
-}
 /**
  * Response from getThreadMeta()
  */

package/dist/index.js

@@ -8327,6 +8327,32 @@ function corsHeaders(contentType) {
   };
 }
 
+// Helper to add CORS headers to any Response without touching the body
+function addCorsHeaders(response) {
+  // Skip WebSocket upgrade responses - they can't be wrapped
+  if (response.status === 101) {
+    return response;
+  }
+
+  // Skip if already has CORS headers
+  if (response.headers.has("Access-Control-Allow-Origin")) {
+    return response;
+  }
+
+  // Create new headers with CORS added
+  const newHeaders = new Headers(response.headers);
+  for (const [key, value] of Object.entries(CORS_HEADERS)) {
+    newHeaders.set(key, value);
+  }
+
+  // Return new Response with same body stream (not cloned, just transferred)
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: newHeaders,
+  });
+}
+
 export async function router(request, env) {
   const url = new URL(request.url);
   const pathname = url.pathname;
@@ -8378,7 +8404,7 @@ ${threadRouteCode}
 
       // If requireAuth returns a Response, it's an error (401)
       if (authResult instanceof Response) {
-        return authResult;
+        return addCorsHeaders(authResult);
       }
 
       authContext = authResult;
@@ -8397,11 +8423,7 @@ ${threadRouteCode}
     const result = await controller(context);
 
     if (result instanceof Response) {
-      // Return Response objects as-is - CORS headers can't be safely added
-      // to Response objects in the workerd environment without issues.
-      // Controllers that return streaming/binary responses should add
-      // CORS headers themselves if needed.
-      return result;
+      return addCorsHeaders(result);
     }
     if (typeof result === "string") {
       return new Response(result, {
@@ -9610,6 +9632,12 @@ function base64ToBuffer(base64) {
 }
 
 // src/middleware/auth.ts
+var CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, PATCH, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Requested-With",
+  "Access-Control-Max-Age": "86400"
+};
 function extractBearerToken(request) {
   const authHeader = request.headers.get("Authorization");
   if (authHeader && authHeader.startsWith("Bearer ")) {
@@ -9698,7 +9726,7 @@ async function requireAuth(request, env) {
   if (!authContext) {
     return new Response(JSON.stringify({ error: "Unauthorized" }), {
       status: 401,
-      headers: { "Content-Type": "application/json" }
+      headers: { "Content-Type": "application/json", ...CORS_HEADERS }
     });
   }
   return authContext;
@@ -9713,7 +9741,7 @@ async function requireAdmin(request, env) {
       JSON.stringify({ error: "Forbidden: Admin access required" }),
       {
         status: 403,
-        headers: { "Content-Type": "application/json" }
+        headers: { "Content-Type": "application/json", ...CORS_HEADERS }
       }
     );
   }