@standardagents/builder 0.37.7 → 0.38.0

package/dist/runtime.d.ts

@@ -1,5 +1,5 @@
-import { i as AuthContext, e as ThreadEnv, v as Agent, x as ThreadMetadata, y as ToolResult, M as Message, n as ClientToolRequest, o as ClientToolResponse, p as ClientStreamRequest, q as ClientStreamResponse, G as FileRecord, F as FlowState, K as FileStats, J as GrepResult, H as AttachmentRef, Q as MessageContent, E as Env, w as ThreadInstance } from './index-Lfan8QMN.js';
-export { A as AuthUser, f as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, B as Controller, a as ControllerContext, z as FlowResult, O as ImageContentPart, I as ImageMetadata, L as LLMResponse, P as MultimodalContent, R as RequestContext, S as StorageBackend, D as TelemetryEvent, N as TextContentPart, b as ThreadEndpointContext, T as ToolCall, g as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-Lfan8QMN.js';
+import { j as AuthContext, e as ThreadEnv, w as Agent, y as ThreadMetadata, z as ToolResult, M as Message, o as ClientToolRequest, p as ClientToolResponse, q as ClientStreamRequest, t as ClientStreamResponse, H as FileRecord, F as FlowState, N as FileStats, K as GrepResult, J as AttachmentRef, U as MessageContent, G as Env, x as ThreadInstance } from './index-BBu-Osn5.js';
+export { A as AuthUser, f as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, u as ClientDuplex, v as ClientForwarding, B as Controller, a as ControllerContext, D as FlowResult, P as ImageContentPart, I as ImageMetadata, L as LLMResponse, Q as MultimodalContent, R as RequestContext, S as StorageBackend, E as TelemetryEvent, O as TextContentPart, b as ThreadEndpointContext, T as ToolCall, g as authenticate, k as callClient, l as callClientStream, c as createThreadEndpointHandler, n as decodeStreamChunk, d as defineController, m as encodeStreamChunk, i as endpointCallerFromAuth, h as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-BBu-Osn5.js';
 import { CodeExecutionOptions, CodeExecutionResult, SubagentRegistryEntry, InjectMessageInput, QueueMessageInput, CredentialGrant, SkillMetadata, SkillFileInput, ModelDefinition as ModelDefinition$1, ToolArgs, PromptTextPart, PromptEnvPart, VariableDefinition, SubpromptConfig as SubpromptConfig$1, PromptToolConfig as PromptToolConfig$1, SubagentToolConfig as SubagentToolConfig$1, ReasoningConfig, SideConfig as SideConfig$1, LLMProviderInterface, ContentPart, TextPart, ImagePart, FilePart, ThreadState, NamespaceContext, DefinitionLoader } from '@standardagents/spec';
 export { AgentType, DefinitionLoader, GlobalNamespaceContext, HookSignatures, ImageContent, ModelCapabilities, ModelProvider, NamespaceContext, PackageSignature, PackedExports, PackedMeta, PackedMetadata, PackedNamespaceContext, PromptInput, PromptTextPart, ProviderAssistantMessage, ProviderError, ProviderErrorCode, ProviderFactory, ProviderFactoryConfig, ProviderFinishReason, ProviderGeneratedImage, ProviderMessage, ProviderMessageContent, ModelCapabilities as ProviderModelCapabilities, ProviderReasoningDetail, ProviderRequest, ProviderResponse, ProviderStreamChunk, ProviderSystemMessage, ProviderTool, ProviderToolCallPart, ProviderToolMessage, ProviderToolResultContent, ProviderUsage, ProviderUserMessage, ReasoningConfig, StructuredPrompt, TextContent, Tool, ToolArgs, ToolArgsNode, ToolArgsRawShape, ToolContent, belongsToPackage, defineAgent, defineHook, defineModel, definePrompt, defineTool, isPacked, isVisibleInNamespace, mapReasoningLevel } from '@standardagents/spec';
 import { DurableObject, WorkerEntrypoint } from 'cloudflare:workers';
@@ -116,6 +116,7 @@ declare function canAccessThread(auth: AuthContext, thread: {
     user_id: string | null;
 }): boolean;
 
+/** Central API exposure policy shared by the generated Worker router and tests. */
 declare function isHostedInstance(env: Record<string, unknown> | undefined): boolean;
 /**
  * Local-only conveniences are enabled by the request destination, not merely

package/dist/runtime.js

@@ -9551,7 +9551,12 @@ ${msg.content}` : `${imageDescriptions}${nonImageList}`;
         const threadState = ThreadStateImpl.fromFlowState(state);
         for (const executor of executors) {
           try {
-            result = await executor(threadState, result);
+            const hooked = await executor(threadState, _FlowEngine.rowToHookMessage(result));
+            result = {
+              ...result,
+              ...hooked,
+              attachments: hooked.attachments === void 0 ? result.attachments : hooked.attachments === null ? null : typeof hooked.attachments === "string" ? hooked.attachments : JSON.stringify(hooked.attachments)
+            };
           } catch (error) {
             console.error("[Hooks] \u2717 Error running before_create_message hook:", error);
           }
@@ -9571,12 +9576,31 @@ ${msg.content}` : `${imageDescriptions}${nonImageList}`;
         const threadState = ThreadStateImpl.fromFlowState(state);
         for (const executor of executors) {
           try {
-            await executor(threadState, message);
+            await executor(threadState, _FlowEngine.rowToHookMessage(message));
           } catch (error) {
             console.error("[Hooks] \u2717 Error running after_create_message hook:", error);
           }
         }
       }
+      /**
+       * Builder rows store `attachments` as a JSON string; the spec hook surface
+       * carries parsed AttachmentRef[]. Convert at every hook boundary so hooks
+       * see the spec shape and cannot corrupt the stored row shape.
+       */
+      static rowToHookMessage(row) {
+        const { attachments, ...rest } = row;
+        let parsed = void 0;
+        if (attachments === null) parsed = null;
+        else if (typeof attachments === "string" && attachments) {
+          try {
+            const p = JSON.parse(attachments);
+            parsed = Array.isArray(p) ? p : void 0;
+          } catch {
+            parsed = void 0;
+          }
+        }
+        return { ...rest, attachments: parsed };
+      }
       /**
        * Run the before_update_message hook if it exists
        * This hook allows developers to modify a message before it's updated
@@ -9615,7 +9639,7 @@ ${msg.content}` : `${imageDescriptions}${nonImageList}`;
         const threadState = ThreadStateImpl.fromFlowState(state);
         for (const executor of executors) {
           try {
-            await executor(threadState, message);
+            await executor(threadState, _FlowEngine.rowToHookMessage(message));
           } catch (error) {
             console.error("[Hooks] \u2717 Error running after_update_message hook:", error);
           }
@@ -10704,7 +10728,11 @@ ${msg.content}` : `${imageDescriptions}${nonImageList}`;
         const threadState = ThreadStateImpl.fromFlowState(state);
         for (const executor of executors) {
           try {
-            result = await executor(threadState, result);
+            const byId = /* @__PURE__ */ new Map();
+            for (const row of result) if (row.id) byId.set(row.id, row);
+            const hookView = result.map((row) => _FlowEngine.rowToHookMessage(row));
+            const kept = await executor(threadState, hookView);
+            result = kept.map((m) => m.id && byId.get(m.id) || null).filter((row) => row !== null);
           } catch (error) {
             console.error("[Hooks] \u2717 Error running filter_messages hook:", error);
           }
@@ -14291,9 +14319,25 @@ var init_ThreadStateImpl = __esm({
           parent_id: msg.parent_id,
           depth: msg.depth,
           silent: msg.silent,
-          metadata: msg.metadata
+          metadata: msg.metadata,
+          status: msg.status,
+          tool_status: msg.tool_status,
+          attachments: this._parseAttachmentRefs(msg.attachments)
         };
       };
+      /** Builder rows store attachments as a JSON string of AttachmentRef[];
+       *  spec messages carry the parsed refs. Dropping them here is what made
+       *  generated assets invisible to every session_state consumer. */
+      _parseAttachmentRefs = (raw) => {
+        if (!raw) return void 0;
+        if (Array.isArray(raw)) return raw;
+        try {
+          const parsed = JSON.parse(raw);
+          return Array.isArray(parsed) ? parsed : void 0;
+        } catch {
+          return void 0;
+        }
+      };
       _mapFileRecord = (record) => {
         return {
           path: record.path,
@@ -14659,54 +14703,6 @@ var init_image_processing = __esm({
 
 // src/router/index.ts
 init_ThreadStateImpl();
-function defineController2(controller) {
-  return controller;
-}
-function createThreadEndpointHandler(handler) {
-  return (async ({ req, params, env }) => {
-    const threadId = params.threadId ?? params.id;
-    if (!threadId) {
-      return Response.json({ error: "Thread ID required" }, { status: 400 });
-    }
-    try {
-      const agentBuilderId = env.AGENT_BUILDER.idFromName("singleton");
-      const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
-      const metadata = await agentBuilder.getThread(threadId);
-      if (!metadata) {
-        return Response.json(
-          { error: `Thread not found: ${threadId}` },
-          { status: 404 }
-        );
-      }
-      const meta = metadata;
-      if (!meta.agent_id && meta.agent_name) {
-        meta.agent_id = meta.agent_name;
-      }
-      const durableId = env.AGENT_BUILDER_THREAD.idFromName(threadId);
-      const stub = env.AGENT_BUILDER_THREAD.get(durableId);
-      const instance = stub;
-      const threadState = ThreadStateImpl.fromThreadInstance(instance, metadata, {
-        env
-      });
-      const endpointParams = {};
-      for (const [key, value] of Object.entries(params)) {
-        if (key === "threadId" || key === "id" && !params.threadId) {
-          continue;
-        }
-        endpointParams[key === "_" ? "*" : key] = value;
-      }
-      const response = await handler(req, threadState, endpointParams);
-      await threadState.flushPendingEventDeliveries();
-      return response;
-    } catch (error) {
-      console.error(`Error in thread endpoint for ${threadId}:`, error);
-      return Response.json(
-        { error: error.message || "Internal server error" },
-        { status: 500 }
-      );
-    }
-  });
-}
 
 // src/utils/auth.ts
 async function hashToken(token) {
@@ -14797,6 +14793,19 @@ var CORS_HEADERS = {
   "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Requested-With",
   "Access-Control-Max-Age": "86400"
 };
+function endpointCallerFromAuth(auth) {
+  if (!auth) return null;
+  const { id, username, role, permissions, email, display_name, avatar_url } = auth.user;
+  return {
+    id,
+    username,
+    role,
+    permissions: permissions ?? null,
+    email: email ?? null,
+    display_name: display_name ?? null,
+    avatar_url: avatar_url ?? null
+  };
+}
 function parsePermissions(value) {
   if (Array.isArray(value)) return value.filter((p) => typeof p === "string");
   if (typeof value === "string" && value.trim()) {
@@ -14931,6 +14940,61 @@ async function requireAdmin(request, env) {
   }
   return result;
 }
+function defineController2(controller) {
+  return controller;
+}
+function createThreadEndpointHandler(handler) {
+  return (async (context) => {
+    const { req, params, env } = context;
+    const threadId = params.threadId ?? params.id;
+    if (!threadId) {
+      return Response.json({ error: "Thread ID required" }, { status: 400 });
+    }
+    const endpointAuth = {
+      caller: endpointCallerFromAuth(context.auth),
+      threadAccess: Boolean(
+        context.threadAccess && context.threadAccess.threadId === threadId
+      )
+    };
+    try {
+      const agentBuilderId = env.AGENT_BUILDER.idFromName("singleton");
+      const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
+      const metadata = await agentBuilder.getThread(threadId);
+      if (!metadata) {
+        return Response.json(
+          { error: `Thread not found: ${threadId}` },
+          { status: 404 }
+        );
+      }
+      const meta = metadata;
+      if (!meta.agent_id && meta.agent_name) {
+        meta.agent_id = meta.agent_name;
+      }
+      const durableId = env.AGENT_BUILDER_THREAD.idFromName(threadId);
+      const stub = env.AGENT_BUILDER_THREAD.get(durableId);
+      const instance = stub;
+      const threadState = ThreadStateImpl.fromThreadInstance(instance, metadata, {
+        env
+      });
+      const endpointParams = {};
+      for (const [key, value] of Object.entries(params)) {
+        if (key === "threadId" || key === "id" && !params.threadId) {
+          continue;
+        }
+        endpointParams[key === "_" ? "*" : key] = value;
+      }
+      const response = await handler(req, threadState, endpointParams, endpointAuth);
+      await threadState.flushPendingEventDeliveries();
+      return response;
+    } catch (error) {
+      console.error(`Error in thread endpoint for ${threadId}:`, error);
+      return Response.json(
+        { error: error.message || "Internal server error" },
+        { status: 500 }
+      );
+    }
+  });
+}
 
 // src/utils/permissions.ts
 function canAccessThread(auth, thread) {
@@ -14963,10 +15027,6 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
 function isProviderIconRoute(routePath) {
   return /^\/api\/providers\/[^/]+\/icon$/.test(routePath);
 }
-function isPublicThreadFileRoute(routePath, method) {
-  if (method !== "GET" && method !== "HEAD") return false;
-  return /^\/api\/threads\/[^/]+\/public\/.+/.test(routePath);
-}
 function isHostedInstance(env) {
   const value = env?.STANDARD_AGENTS_HOSTED;
   if (typeof value === "string") {
@@ -14993,9 +15053,6 @@ function isPublicApiRoute(routePath, request, env) {
   if (isProviderIconRoute(routePath)) {
     return true;
   }
-  if (isPublicThreadFileRoute(routePath, request.method.toUpperCase())) {
-    return true;
-  }
   if (!isTrustedLocalDevelopmentRequest(request, env)) return false;
   return routePath === "/api/threads" || routePath.startsWith("/api/threads/") || routePath === "/api/platform" || routePath.startsWith("/api/platform/") || routePath === "/api/platform-session" || routePath.startsWith("/api/platform-session/") || routePath === "/api/platform-auth" || routePath.startsWith("/api/platform-auth/");
 }
@@ -28990,6 +29047,6 @@ init_context();
 init_ProviderRegistry();
 init_types2();
 
-export { CLIENT_STREAM_CHUNK_BYTES, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, NamespaceResolutionError, ProviderRegistry, ThreadWatchdog, authenticate, buildImageDescription, callClient, callClientStream, canAccessThread, cat, createNamespaceContext, createThreadEndpointHandler, decodeStreamChunk, defineController2 as defineController, emitThreadEvent, encodeStreamChunk, enhanceFlowState, exists, find, forceTurn, generateImageDescription, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isTrustedLocalDevelopmentRequest, linkFile, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, requireAdmin, requireAuth, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, supportsClientForwarding, tail, unlink, updateThread, writeFile, writeImage };
+export { CLIENT_STREAM_CHUNK_BYTES, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, NamespaceResolutionError, ProviderRegistry, ThreadWatchdog, authenticate, buildImageDescription, callClient, callClientStream, canAccessThread, cat, createNamespaceContext, createThreadEndpointHandler, decodeStreamChunk, defineController2 as defineController, emitThreadEvent, encodeStreamChunk, endpointCallerFromAuth, enhanceFlowState, exists, find, forceTurn, generateImageDescription, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isTrustedLocalDevelopmentRequest, linkFile, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, requireAdmin, requireAuth, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, supportsClientForwarding, tail, unlink, updateThread, writeFile, writeImage };
 //# sourceMappingURL=runtime.js.map
 //# sourceMappingURL=runtime.js.map