@standardagents/builder 0.37.8 → 0.38.0

package/dist/{index-Lfan8QMN.d.ts → index-BBu-Osn5.d.ts}

@@ -1,7 +1,7 @@
 import { DurableObjectStorage } from '@cloudflare/workers-types';
 import { ZodObject, ZodRawShape } from 'zod';
 import { N as NamespacedRegistry } from './types-Bpe7IANZ.js';
-import { ThreadState, ToolResult as ToolResult$1, VariableDefinition, HookName, HookSignatures, HookMessage, HookToolCall, HookToolResult, CodeExecutionOptions, CodeExecutionResult, InjectMessageInput, QueueMessageInput, SubagentRegistryEntry, ProviderUsagePricing, AgentDefinition, SkillMetadata, SkillFileInput, ControllerContext, Controller, ThreadEndpointHandler } from '@standardagents/spec';
+import { ThreadState, ToolResult as ToolResult$1, VariableDefinition, HookName, HookSignatures, HookMessage, HookToolCall, HookToolResult, CodeExecutionOptions, CodeExecutionResult, InjectMessageInput, QueueMessageInput, SubagentRegistryEntry, ProviderUsagePricing, ThreadUser, AgentDefinition, SkillMetadata, SkillFileInput, ControllerContext, Controller, ThreadEndpointHandler } from '@standardagents/spec';
 
 /**
  * Callback function to execute before stream closes
@@ -1120,6 +1120,7 @@ interface FileStats {
  * - User session token (validated against DurableAgentBuilder)
  * - API key (validated against DurableAgentBuilder)
  */
+
 interface AuthUser {
     id: string;
     username: string;
@@ -1139,6 +1140,13 @@ interface AuthContext {
     user: AuthUser;
     authType: 'super_admin' | 'session' | 'api_key';
 }
+/**
+ * Project an authenticated request onto the spec's endpoint caller identity
+ * (`ThreadEndpointAuth.caller` / `ControllerContext.caller`). Returns exactly
+ * the spec `ThreadUser` fields — internal extras like `platform_user_id`
+ * never reach endpoint code.
+ */
+declare function endpointCallerFromAuth(auth: AuthContext | null | undefined): ThreadUser | null;
 /**
  * Authenticate a request using various token types
  */
@@ -1851,4 +1859,4 @@ declare function defineController<Env extends ThreadEnv = ThreadEnv>(controller:
  */
 declare function createThreadEndpointHandler<Env extends ThreadEnv = ThreadEnv>(handler: ThreadEndpointHandler): BuilderController<Env>;
 
-export { type AuthUser as A, type BuilderController as B, CLIENT_STREAM_CHUNK_BYTES as C, type TelemetryEvent as D, type Env as E, type FlowState as F, type FileRecord as G, type AttachmentRef as H, type ImageMetadata as I, type GrepResult as J, type FileStats as K, type LLMResponse as L, type Message as M, type TextContentPart as N, type ImageContentPart as O, type MultimodalContent as P, type MessageContent as Q, type RequestContext as R, type StorageBackend as S, type ToolCall as T, type BuilderControllerContext as a, type ThreadEndpointContext as b, createThreadEndpointHandler as c, defineController as d, type ThreadEnv as e, type BuilderThreadEndpointHandler as f, authenticate as g, requireAdmin as h, type AuthContext as i, callClient as j, callClientStream as k, encodeStreamChunk as l, decodeStreamChunk as m, type ClientToolRequest as n, type ClientToolResponse as o, type ClientStreamRequest as p, type ClientStreamResponse as q, requireAuth as r, supportsClientForwarding as s, type ClientDuplex as t, type ClientForwarding as u, type Agent as v, type ThreadInstance as w, type ThreadMetadata as x, type ToolResult as y, type FlowResult as z };
+export { type AuthUser as A, type BuilderController as B, CLIENT_STREAM_CHUNK_BYTES as C, type FlowResult as D, type TelemetryEvent as E, type FlowState as F, type Env as G, type FileRecord as H, type ImageMetadata as I, type AttachmentRef as J, type GrepResult as K, type LLMResponse as L, type Message as M, type FileStats as N, type TextContentPart as O, type ImageContentPart as P, type MultimodalContent as Q, type RequestContext as R, type StorageBackend as S, type ToolCall as T, type MessageContent as U, type BuilderControllerContext as a, type ThreadEndpointContext as b, createThreadEndpointHandler as c, defineController as d, type ThreadEnv as e, type BuilderThreadEndpointHandler as f, authenticate as g, requireAdmin as h, endpointCallerFromAuth as i, type AuthContext as j, callClient as k, callClientStream as l, encodeStreamChunk as m, decodeStreamChunk as n, type ClientToolRequest as o, type ClientToolResponse as p, type ClientStreamRequest as q, requireAuth as r, supportsClientForwarding as s, type ClientStreamResponse as t, type ClientDuplex as u, type ClientForwarding as v, type Agent as w, type ThreadInstance as x, type ThreadMetadata as y, type ToolResult as z };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { ModelDefinition, AgentDefinition } from './runtime.js';
 export { AgentBuilderEnv, AgentBuilderEvent, BroadcastOptions, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, FlowStateWithSdk, HubClientInfo, ImageContextConfig, InjectMessageOptions, LLMProviderInterface, NamespaceResolutionError, PromptContent, PromptDefinition, PromptIncludePart, PromptPart, PromptToolConfig, Provider, ProviderContentPart, ProviderFilePart, ProviderImagePart, ProviderRegistry, ProviderTextPart, SessionToolBinding, SessionToolConfig, SideConfig, SubagentToolConfig, SubpromptConfig, ThreadEventPayload, ThreadRegistryEntry, ThreadWatchdog, ThreadWatchdogState, ToolConfig, UpdateThreadParams, User, WatchdogCheckin, WatchdogProbeResult, buildImageDescription, canAccessThread, cat, createNamespaceContext, emitThreadEvent, enhanceFlowState, exists, find, forceTurn, generateImageDescription, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isTrustedLocalDevelopmentRequest, linkFile, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, tail, unlink, updateThread, writeFile, writeImage } from './runtime.js';
 export { AgentPluginOptions, agentbuilder, builder } from './plugin.js';
-export { v as Agent, H as AttachmentRef, i as AuthContext, A as AuthUser, f as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, p as ClientStreamRequest, q as ClientStreamResponse, n as ClientToolRequest, o as ClientToolResponse, B as Controller, a as ControllerContext, E as Env, G as FileRecord, K as FileStats, z as FlowResult, F as FlowState, J as GrepResult, O as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, Q as MessageContent, P as MultimodalContent, R as RequestContext, S as StorageBackend, D as TelemetryEvent, N as TextContentPart, b as ThreadEndpointContext, e as ThreadEnv, w as ThreadInstance, x as ThreadMetadata, T as ToolCall, y as ToolResult, g as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-Lfan8QMN.js';
+export { w as Agent, J as AttachmentRef, j as AuthContext, A as AuthUser, f as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, u as ClientDuplex, v as ClientForwarding, q as ClientStreamRequest, t as ClientStreamResponse, o as ClientToolRequest, p as ClientToolResponse, B as Controller, a as ControllerContext, G as Env, H as FileRecord, N as FileStats, D as FlowResult, F as FlowState, K as GrepResult, P as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, U as MessageContent, Q as MultimodalContent, R as RequestContext, S as StorageBackend, E as TelemetryEvent, O as TextContentPart, b as ThreadEndpointContext, e as ThreadEnv, x as ThreadInstance, y as ThreadMetadata, T as ToolCall, z as ToolResult, g as authenticate, k as callClient, l as callClientStream, c as createThreadEndpointHandler, n as decodeStreamChunk, d as defineController, m as encodeStreamChunk, i as endpointCallerFromAuth, h as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-BBu-Osn5.js';
 export { AgentType, DefinitionLoader, GlobalNamespaceContext, HookSignatures, ImageContent, ModelCapabilities, ModelProvider, NamespaceContext, PackageSignature, PackedExports, PackedMeta, PackedMetadata, PackedNamespaceContext, PromptInput, PromptTextPart, ProviderAssistantMessage, ProviderConfigSlot, ProviderConfigSlots, ProviderConfigValueSource, ProviderDefinition, ProviderError, ProviderErrorCode, ProviderFactory, ProviderFactoryConfig, ProviderFinishReason, ProviderGeneratedImage, ProviderMessage, ProviderMessageContent, ProviderMethodOverrides, ModelCapabilities as ProviderModelCapabilities, ProviderOverride, ProviderOverrideContext, ProviderReasoningDetail, ProviderRequest, ProviderResponse, ProviderStreamChunk, ProviderSyncOverride, ProviderSystemMessage, ProviderTool, ProviderToolCallPart, ProviderToolMessage, ProviderToolResultContent, ProviderUsage, ProviderUserMessage, ReasoningConfig, StructuredPrompt, TextContent, Tool, ToolArgs, ToolArgsNode, ToolArgsRawShape, ToolContent, belongsToPackage, defineAgent, defineHook, defineModel, definePrompt, defineProvider, defineTool, isPacked, isVisibleInNamespace, mapReasoningLevel, providerConst, providerEnv, providerValue } from '@standardagents/spec';
 export { C as ConstituentItem, D as DiscoveredPackage, N as NamespacedRegistry, P as PackingAnalysis, a as PackingOptions, b as PackingResult, c as UnpackOptions, d as UnpackResult } from './types-Bpe7IANZ.js';
 export { D as DiscoveryConfig, P as PackageDiscoveryService, d as discoverPackages } from './discovery-DiMJWisl.js';

package/dist/index.js

@@ -21414,10 +21414,6 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
 function isProviderIconRoute(routePath) {
   return /^\/api\/providers\/[^/]+\/icon$/.test(routePath);
 }
-function isPublicThreadFileRoute(routePath, method) {
-  if (method !== "GET" && method !== "HEAD") return false;
-  return /^\/api\/threads\/[^/]+\/public\/.+/.test(routePath);
-}
 function isHostedInstance(env) {
   const value = env?.STANDARD_AGENTS_HOSTED;
   if (typeof value === "string") {
@@ -21444,9 +21440,6 @@ function isPublicApiRoute(routePath, request, env) {
   if (isProviderIconRoute(routePath)) {
     return true;
   }
-  if (isPublicThreadFileRoute(routePath, request.method.toUpperCase())) {
-    return true;
-  }
   if (!isTrustedLocalDevelopmentRequest(request, env)) return false;
   return routePath === "/api/threads" || routePath.startsWith("/api/threads/") || routePath === "/api/platform" || routePath.startsWith("/api/platform/") || routePath === "/api/platform-session" || routePath.startsWith("/api/platform-session/") || routePath === "/api/platform-auth" || routePath.startsWith("/api/platform-auth/");
 }
@@ -22200,14 +22193,16 @@ import { prompts, promptNames } from "virtual:@standardagents-prompts";
 import { agents, agentNames } from "virtual:@standardagents-agents";
 import { registry } from "virtual:@standardagents-registry";
 import {
+  authenticate,
   requireAuth,
   createThreadEndpointHandler,
   canAccessThread,
+  endpointCallerFromAuth,
   isHostedInstance,
   isPublicApiRoute,
   isAdminOnlyApiRoute,
 } from "@standardagents/builder/runtime";
-import { isThreadEndpoint } from "@standardagents/spec";
+import { isThreadEndpoint, getEndpointAccess } from "@standardagents/spec";
 
 function platformEndpoint(env) {
   const configured =
@@ -22350,8 +22345,16 @@ ${packedThreadRouteCode}
   );
 
   if (routeMatch) {
+    let controller = await routeMatch.data();
+
+    // Endpoint-declared access (spec: EndpointAccess). A 'public' declaration
+    // opts that one endpoint out of the router's authentication gate; the
+    // handler still receives the resolved caller identity when the request
+    // presents verifiable credentials.
+    const declaredPublic = getEndpointAccess(controller) === 'public';
+
     // Check if authentication is required for this route
-    const publicRoute = isPublicApiRoute(routePath, request, env);
+    const publicRoute = declaredPublic || isPublicApiRoute(routePath, request, env);
     const isApiRoute = routePath.startsWith('/api/');
 
     let authContext = null;
@@ -22394,10 +22397,24 @@ ${packedThreadRouteCode}
           threadAccess = { threadId, thread };
         }
       }
+    } else if (isApiRoute && declaredPublic) {
+      // Optional caller resolution for endpoint-declared public routes:
+      // verifiable credentials attribute the request, anything else stays
+      // anonymous instead of being rejected (spec ThreadEndpointAuth).
+      authContext = await authenticate(request, env);
+      if (authContext && routePath.startsWith('/api/threads/')) {
+        const threadId = routeMatch.params?.threadId || routeMatch.params?.id;
+        if (threadId) {
+          const agentBuilderId = env.AGENT_BUILDER.idFromName('singleton');
+          const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
+          const thread = await agentBuilder.getThread(threadId);
+          if (thread && canAccessThread(authContext, thread)) {
+            threadAccess = { threadId, thread };
+          }
+        }
+      }
     }
 
-    let controller = await routeMatch.data();
-
     // Check if this is a thread endpoint (marked by defineThreadEndpoint)
     // If so, wrap it with createThreadEndpointHandler to provide ThreadState
     if (isThreadEndpoint(controller)) {
@@ -22412,6 +22429,7 @@ ${packedThreadRouteCode}
       config,
       tools,
       auth: authContext, // Add auth context to controller context
+      caller: endpointCallerFromAuth(authContext), // Spec ControllerContext.caller
       threadAccess, // Router's thread authorization, bound to the exact id
     };
     const result = await controller(context);
@@ -23192,54 +23210,6 @@ var builder = agentbuilder;
 
 // src/router/index.ts
 init_ThreadStateImpl();
-function defineController2(controller) {
-  return controller;
-}
-function createThreadEndpointHandler(handler) {
-  return (async ({ req, params, env }) => {
-    const threadId = params.threadId ?? params.id;
-    if (!threadId) {
-      return Response.json({ error: "Thread ID required" }, { status: 400 });
-    }
-    try {
-      const agentBuilderId = env.AGENT_BUILDER.idFromName("singleton");
-      const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
-      const metadata = await agentBuilder.getThread(threadId);
-      if (!metadata) {
-        return Response.json(
-          { error: `Thread not found: ${threadId}` },
-          { status: 404 }
-        );
-      }
-      const meta = metadata;
-      if (!meta.agent_id && meta.agent_name) {
-        meta.agent_id = meta.agent_name;
-      }
-      const durableId = env.AGENT_BUILDER_THREAD.idFromName(threadId);
-      const stub = env.AGENT_BUILDER_THREAD.get(durableId);
-      const instance = stub;
-      const threadState = ThreadStateImpl.fromThreadInstance(instance, metadata, {
-        env
-      });
-      const endpointParams = {};
-      for (const [key, value] of Object.entries(params)) {
-        if (key === "threadId" || key === "id" && !params.threadId) {
-          continue;
-        }
-        endpointParams[key === "_" ? "*" : key] = value;
-      }
-      const response = await handler(req, threadState, endpointParams);
-      await threadState.flushPendingEventDeliveries();
-      return response;
-    } catch (error) {
-      console.error(`Error in thread endpoint for ${threadId}:`, error);
-      return Response.json(
-        { error: error.message || "Internal server error" },
-        { status: 500 }
-      );
-    }
-  });
-}
 
 // src/utils/auth.ts
 async function hashToken(token) {
@@ -23330,6 +23300,19 @@ var CORS_HEADERS = {
   "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Requested-With",
   "Access-Control-Max-Age": "86400"
 };
+function endpointCallerFromAuth(auth) {
+  if (!auth) return null;
+  const { id, username, role, permissions, email, display_name, avatar_url } = auth.user;
+  return {
+    id,
+    username,
+    role,
+    permissions: permissions ?? null,
+    email: email ?? null,
+    display_name: display_name ?? null,
+    avatar_url: avatar_url ?? null
+  };
+}
 function parsePermissions(value) {
   if (Array.isArray(value)) return value.filter((p) => typeof p === "string");
   if (typeof value === "string" && value.trim()) {
@@ -23464,6 +23447,61 @@ async function requireAdmin(request, env) {
   }
   return result;
 }
+function defineController2(controller) {
+  return controller;
+}
+function createThreadEndpointHandler(handler) {
+  return (async (context) => {
+    const { req, params, env } = context;
+    const threadId = params.threadId ?? params.id;
+    if (!threadId) {
+      return Response.json({ error: "Thread ID required" }, { status: 400 });
+    }
+    const endpointAuth = {
+      caller: endpointCallerFromAuth(context.auth),
+      threadAccess: Boolean(
+        context.threadAccess && context.threadAccess.threadId === threadId
+      )
+    };
+    try {
+      const agentBuilderId = env.AGENT_BUILDER.idFromName("singleton");
+      const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
+      const metadata = await agentBuilder.getThread(threadId);
+      if (!metadata) {
+        return Response.json(
+          { error: `Thread not found: ${threadId}` },
+          { status: 404 }
+        );
+      }
+      const meta = metadata;
+      if (!meta.agent_id && meta.agent_name) {
+        meta.agent_id = meta.agent_name;
+      }
+      const durableId = env.AGENT_BUILDER_THREAD.idFromName(threadId);
+      const stub = env.AGENT_BUILDER_THREAD.get(durableId);
+      const instance = stub;
+      const threadState = ThreadStateImpl.fromThreadInstance(instance, metadata, {
+        env
+      });
+      const endpointParams = {};
+      for (const [key, value] of Object.entries(params)) {
+        if (key === "threadId" || key === "id" && !params.threadId) {
+          continue;
+        }
+        endpointParams[key === "_" ? "*" : key] = value;
+      }
+      const response = await handler(req, threadState, endpointParams, endpointAuth);
+      await threadState.flushPendingEventDeliveries();
+      return response;
+    } catch (error) {
+      console.error(`Error in thread endpoint for ${threadId}:`, error);
+      return Response.json(
+        { error: error.message || "Internal server error" },
+        { status: 500 }
+      );
+    }
+  });
+}
 
 // src/utils/permissions.ts
 function canAccessThread(auth, thread) {
@@ -37449,6 +37487,6 @@ init_context();
 init_ProviderRegistry();
 init_types2();
 
-export { CLIENT_STREAM_CHUNK_BYTES, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, NamespaceResolutionError, PackageDiscoveryService, ProviderRegistry, ThreadWatchdog, agentbuilder, assistantMessageText, authenticate, buildImageDescription, builder, callClient, callClientStream, canAccessThread, cat, createNamespaceContext, createThreadEndpointHandler, decodeStreamChunk, defineController2 as defineController, discoverPackages, emitThreadEvent, encodeStreamChunk, enhanceFlowState, exists, find, forceTurn, generateAgentFile, generateImageDescription, generateModelFile, generatePromptFile, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, hasJsonArrayEntries, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isTrustedLocalDevelopmentRequest, isVisibleTerminalAssistantMessage, linkFile, messageTimestampSeconds, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, requireAdmin, requireAuth, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, supportsClientForwarding, tail, unlink, updateThread, writeFile, writeImage };
+export { CLIENT_STREAM_CHUNK_BYTES, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, NamespaceResolutionError, PackageDiscoveryService, ProviderRegistry, ThreadWatchdog, agentbuilder, assistantMessageText, authenticate, buildImageDescription, builder, callClient, callClientStream, canAccessThread, cat, createNamespaceContext, createThreadEndpointHandler, decodeStreamChunk, defineController2 as defineController, discoverPackages, emitThreadEvent, encodeStreamChunk, endpointCallerFromAuth, enhanceFlowState, exists, find, forceTurn, generateAgentFile, generateImageDescription, generateModelFile, generatePromptFile, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, hasJsonArrayEntries, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isTrustedLocalDevelopmentRequest, isVisibleTerminalAssistantMessage, linkFile, messageTimestampSeconds, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, requireAdmin, requireAuth, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, stat, supportsClientForwarding, tail, unlink, updateThread, writeFile, writeImage };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map