@standardagents/builder 0.23.0 → 0.24.0

package/dist/built-in-routes.js

@@ -64307,14 +64307,13 @@ async function getPlatformIdentity(env2) {
     platformEndpoint: endpoint
   };
 }
-async function mintLocalSessionForPlatformUser(env2, platformUser) {
+async function upsertReplicaUserForPlatformProfile(env2, profile) {
   const namespace = env2.AGENT_BUILDER;
   if (!namespace || typeof namespace.idFromName !== "function" || typeof namespace.get !== "function") {
     throw new Error("Server misconfigured: AGENT_BUILDER Durable Object binding is required for platform auth");
   }
   const agentBuilder = namespace.get(namespace.idFromName("singleton"));
-  const profile = typeof platformUser === "string" ? { platform_user_id: platformUser, username: `sa-${platformUser.slice(0, 12)}`, role: "admin" } : platformUser;
-  const user = await agentBuilder.upsertPlatformReplicaUser({
+  return await agentBuilder.upsertPlatformReplicaUser({
     platform_user_id: profile.platform_user_id,
     username: profile.username ?? null,
     display_name: profile.display_name ?? null,
@@ -64323,6 +64322,15 @@ async function mintLocalSessionForPlatformUser(env2, platformUser) {
     role: profile.role ?? "admin",
     permissions: profile.permissions ?? null
   });
+}
+async function mintLocalSessionForPlatformUser(env2, platformUser) {
+  const namespace = env2.AGENT_BUILDER;
+  if (!namespace || typeof namespace.idFromName !== "function" || typeof namespace.get !== "function") {
+    throw new Error("Server misconfigured: AGENT_BUILDER Durable Object binding is required for platform auth");
+  }
+  const agentBuilder = namespace.get(namespace.idFromName("singleton"));
+  const profile = typeof platformUser === "string" ? { platform_user_id: platformUser, username: `sa-${platformUser.slice(0, 12)}`, role: "admin" } : platformUser;
+  const user = await upsertReplicaUserForPlatformProfile(env2, profile);
   if (user.role === "api") {
     throw new Error("This account has API-only access. Use an API key instead of signing in.");
   }
@@ -70111,9 +70119,11 @@ var start_post_default = defineController2(async ({ req, env: env2 }) => {
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
   await agentBuilder.startDeviceLogin(await hashToken(code));
   const origin = new URL(req.url).origin;
+  const verifyBaseRaw = env2.STANDARD_AGENTS_DEVICE_VERIFY_URL_BASE;
+  const verifyBase = typeof verifyBaseRaw === "string" ? verifyBaseRaw.trim().replace(/\/+$/, "") : "";
   return Response.json({
     code,
-    verify_url: `${origin}/api/auth/device/${code}/approve`,
+    verify_url: verifyBase ? `${verifyBase}/${code}` : `${origin}/api/auth/device/${code}/approve`,
     poll_url: `${origin}/api/auth/device/${code}`,
     interval: 2,
     expires_in: 600
@@ -70169,6 +70179,15 @@ var callback_get_default = defineController2(async ({ req, env: env2 }) => {
     return failRedirect(req, env2, "forbidden");
   }
   if (payload.role === "api") {
+    const apiReturnTo = safeReturnTo2(url.searchParams.get("return_to"));
+    if (/^\/api\/auth\/device\/[A-Za-z0-9]{8,64}\/approve$/.test(apiReturnTo)) {
+      return new Response(null, {
+        status: 302,
+        headers: {
+          Location: `${url.origin}${apiReturnTo}?handoff=${encodeURIComponent(handoff)}`
+        }
+      });
+    }
     return failRedirect(req, env2, "api_only_account");
   }
   const session = await mintLocalSessionForPlatformUser(env2, {
@@ -70282,23 +70301,49 @@ function page(title, body, ok) {
 var approve_get_default = defineController2(async ({ req, env: env2, params }) => {
   const code = params.code;
   if (!code) return page("Missing code", "This device link is malformed.", false);
-  const authResult = await requireAuth(req, env2);
-  if (authResult instanceof Response) {
-    const url = new URL(req.url);
-    const returnTo = encodeURIComponent(url.pathname);
-    const hosted = Boolean(env2.STANDARD_AGENTS_HOSTED && String(env2.STANDARD_AGENTS_HOSTED) !== "0" && String(env2.STANDARD_AGENTS_HOSTED).toLowerCase() !== "false");
-    const target = hosted ? `/api/auth/sa/start?return_to=${returnTo}` : `/login?return_to=${returnTo}`;
-    return new Response(null, { status: 302, headers: { Location: `${url.origin}${target}` } });
-  }
-  if (authResult.authType === "api_key") {
-    return page("Sign in required", "Device logins must be approved from a signed-in browser session.", false);
+  const url = new URL(req.url);
+  let approvingUserId = null;
+  const handoff = url.searchParams.get("handoff");
+  if (handoff && isPlatformHosted(env2)) {
+    const configuredProjectId = typeof env2.STANDARD_AGENTS_PROJECT_ID === "string" ? env2.STANDARD_AGENTS_PROJECT_ID : void 0;
+    const payload = await verifyPlatformSignedPayload(
+      handoff,
+      env2.STANDARD_AGENTS_AUTH_PUBLIC_KEY_JWK ?? env2.STANDARD_AGENTS_AUTH_PUBLIC_KEY,
+      { kind: "instance_handoff", projectId: configuredProjectId }
+    );
+    const projectOk = payload && (configuredProjectId || payload.project_id === hostedInstanceRedirectId(req, env2));
+    if (!payload || !payload.platform_user_id || !payload.role || !projectOk) {
+      return page("Sign in failed", "This sign-in link is invalid or has expired. Start again from your terminal.", false);
+    }
+    const user = await upsertReplicaUserForPlatformProfile(env2, {
+      platform_user_id: payload.platform_user_id,
+      username: payload.username ?? null,
+      display_name: payload.display_name ?? null,
+      email: payload.email ?? null,
+      avatar_url: payload.avatar_url ?? null,
+      role: payload.role,
+      permissions: payload.permissions ?? null
+    });
+    approvingUserId = user.id;
+  } else {
+    const authResult = await requireAuth(req, env2);
+    if (authResult instanceof Response) {
+      const returnTo = encodeURIComponent(url.pathname);
+      const hosted = Boolean(env2.STANDARD_AGENTS_HOSTED && String(env2.STANDARD_AGENTS_HOSTED) !== "0" && String(env2.STANDARD_AGENTS_HOSTED).toLowerCase() !== "false");
+      const target = hosted ? `/api/auth/sa/start?return_to=${returnTo}` : `/login?return_to=${returnTo}`;
+      return new Response(null, { status: 302, headers: { Location: `${url.origin}${target}` } });
+    }
+    if (authResult.authType === "api_key") {
+      return page("Sign in required", "Device logins must be approved from a signed-in browser session.", false);
+    }
+    approvingUserId = authResult.user.id;
   }
   const token = generateApiKey();
   const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
   const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
   const ok = await agentBuilder.approveDeviceLogin({
     code_hash: await hashToken(code),
-    user_id: authResult.user.id,
+    user_id: approvingUserId,
     token,
     token_hash: await hashToken(token),
     key_prefix: token.slice(0, 12),