@standardagents/builder 0.37.3 → 0.37.5

package/dist/{index-DceFbLG9.d.ts → index-Lfan8QMN.d.ts}

@@ -1154,6 +1154,46 @@ declare function requireAuth(request: Request, env: any): Promise<AuthContext |
  */
 declare function requireAdmin(request: Request, env: any): Promise<AuthContext | Response>;
 
+/**
+ * Same-request reuse of the router's authentication and thread-authorization
+ * work (AB-05, coordinator docs/plans/active/CLOUDFLARE_COST_FINDINGS.md).
+ *
+ * The generated runtime router authenticates every protected API request and,
+ * for thread routes, loads the registry record and checks thread access —
+ * then controllers historically repeated the exact same singleton RPCs
+ * (validateSession/validateApiKey + getUserById, getThread), doubling
+ * singleton traffic on every protected request.
+ *
+ * SECURITY CONTRACT (the AB-05 gate):
+ * - Reuse happens ONLY within one incoming request: the router computes these
+ *   values per request and passes them as explicit controller-context data.
+ *   There is NO cross-request cache, NO module-global map, NO retained
+ *   tokens/cookies/identities — revocation is effective on the next request
+ *   because the next request re-authenticates from scratch.
+ * - Thread authorization is bound to the EXACT thread id the router
+ *   authorized. A controller asking about any other id (including nested
+ *   route params also named `id`) gets null and falls back to its own
+ *   lookup + access check.
+ * - Permission-specific checks stay at the operation boundary: reusing the
+ *   authenticated identity never implies a permission; helpers re-evaluate
+ *   `hasPermission`/role against the reused context on every call.
+ * - Controllers invoked WITHOUT router context (direct tests, standalone
+ *   invocation, trusted-local public routes) execute their historical
+ *   authentication path unchanged.
+ */
+
+/** The router's thread-authorization result, bound to one exact thread id. */
+interface RouterThreadAccess {
+    /** The thread id (as matched from the route) the router authorized. */
+    threadId: string;
+    /**
+     * The registry record the router loaded while authorizing. Same-request
+     * read-only reuse only — a controller that mutates thread metadata must
+     * re-read after its mutation rather than trusting this snapshot.
+     */
+    thread: Record<string, unknown>;
+}
+
 /**
  * Router and endpoint definition module for AgentBuilder.
  *
@@ -1740,6 +1780,12 @@ interface BuilderControllerContext<Env extends ThreadEnv = ThreadEnv> extends Om
     registry?: NamespacedRegistry;
     /** Authenticated caller, populated by the generated runtime router. */
     auth?: AuthContext | null;
+    /**
+     * The router's thread-authorization result for this request, bound to the
+     * exact matched thread id (AB-05 same-request reuse). Populated only after
+     * the router's own getThread + canAccessThread checks passed.
+     */
+    threadAccess?: RouterThreadAccess | null;
 }
 /**
  * Builder-specific controller type with typed env.

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { ModelDefinition, AgentDefinition } from './runtime.js';
 export { AgentBuilderEnv, AgentBuilderEvent, BroadcastOptions, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, FlowStateWithSdk, HubClientInfo, ImageContextConfig, InjectMessageOptions, LLMProviderInterface, NamespaceResolutionError, PromptContent, PromptDefinition, PromptIncludePart, PromptPart, PromptToolConfig, Provider, ProviderContentPart, ProviderFilePart, ProviderImagePart, ProviderRegistry, ProviderTextPart, SessionToolBinding, SessionToolConfig, SideConfig, SubagentToolConfig, SubpromptConfig, ThreadEventPayload, ThreadRegistryEntry, ThreadWatchdog, ThreadWatchdogState, ToolConfig, UpdateThreadParams, User, WatchdogCheckin, WatchdogProbeResult, buildImageDescription, canAccessThread, cat, createNamespaceContext, emitThreadEvent, enhanceFlowState, exists, find, forceTurn, generateImageDescription, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isTrustedLocalDevelopmentRequest, linkFile, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, tail, unlink, updateThread, writeFile, writeImage } from './runtime.js';
 export { AgentPluginOptions, agentbuilder, builder } from './plugin.js';
-export { v as Agent, H as AttachmentRef, i as AuthContext, A as AuthUser, f as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, p as ClientStreamRequest, q as ClientStreamResponse, n as ClientToolRequest, o as ClientToolResponse, B as Controller, a as ControllerContext, E as Env, G as FileRecord, K as FileStats, z as FlowResult, F as FlowState, J as GrepResult, O as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, Q as MessageContent, P as MultimodalContent, R as RequestContext, S as StorageBackend, D as TelemetryEvent, N as TextContentPart, b as ThreadEndpointContext, e as ThreadEnv, w as ThreadInstance, x as ThreadMetadata, T as ToolCall, y as ToolResult, g as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-DceFbLG9.js';
+export { v as Agent, H as AttachmentRef, i as AuthContext, A as AuthUser, f as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, p as ClientStreamRequest, q as ClientStreamResponse, n as ClientToolRequest, o as ClientToolResponse, B as Controller, a as ControllerContext, E as Env, G as FileRecord, K as FileStats, z as FlowResult, F as FlowState, J as GrepResult, O as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, Q as MessageContent, P as MultimodalContent, R as RequestContext, S as StorageBackend, D as TelemetryEvent, N as TextContentPart, b as ThreadEndpointContext, e as ThreadEnv, w as ThreadInstance, x as ThreadMetadata, T as ToolCall, y as ToolResult, g as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-Lfan8QMN.js';
 export { AgentType, DefinitionLoader, GlobalNamespaceContext, HookSignatures, ImageContent, ModelCapabilities, ModelProvider, NamespaceContext, PackageSignature, PackedExports, PackedMeta, PackedMetadata, PackedNamespaceContext, PromptInput, PromptTextPart, ProviderAssistantMessage, ProviderConfigSlot, ProviderConfigSlots, ProviderConfigValueSource, ProviderDefinition, ProviderError, ProviderErrorCode, ProviderFactory, ProviderFactoryConfig, ProviderFinishReason, ProviderGeneratedImage, ProviderMessage, ProviderMessageContent, ProviderMethodOverrides, ModelCapabilities as ProviderModelCapabilities, ProviderOverride, ProviderOverrideContext, ProviderReasoningDetail, ProviderRequest, ProviderResponse, ProviderStreamChunk, ProviderSyncOverride, ProviderSystemMessage, ProviderTool, ProviderToolCallPart, ProviderToolMessage, ProviderToolResultContent, ProviderUsage, ProviderUserMessage, ReasoningConfig, StructuredPrompt, TextContent, Tool, ToolArgs, ToolArgsNode, ToolArgsRawShape, ToolContent, belongsToPackage, defineAgent, defineHook, defineModel, definePrompt, defineProvider, defineTool, isPacked, isVisibleInNamespace, mapReasoningLevel, providerConst, providerEnv, providerValue } from '@standardagents/spec';
 export { C as ConstituentItem, D as DiscoveredPackage, N as NamespacedRegistry, P as PackingAnalysis, a as PackingOptions, b as PackingResult, c as UnpackOptions, d as UnpackResult } from './types-Bpe7IANZ.js';
 export { D as DiscoveryConfig, P as PackageDiscoveryService, d as discoverPackages } from './discovery-DiMJWisl.js';