@standardagents/builder 0.37.8 → 0.38.0

package/dist/plugin.js

@@ -7462,14 +7462,16 @@ import { prompts, promptNames } from "virtual:@standardagents-prompts";
 import { agents, agentNames } from "virtual:@standardagents-agents";
 import { registry } from "virtual:@standardagents-registry";
 import {
+  authenticate,
   requireAuth,
   createThreadEndpointHandler,
   canAccessThread,
+  endpointCallerFromAuth,
   isHostedInstance,
   isPublicApiRoute,
   isAdminOnlyApiRoute,
 } from "@standardagents/builder/runtime";
-import { isThreadEndpoint } from "@standardagents/spec";
+import { isThreadEndpoint, getEndpointAccess } from "@standardagents/spec";
 
 function platformEndpoint(env) {
   const configured =
@@ -7612,8 +7614,16 @@ ${packedThreadRouteCode}
   );
 
   if (routeMatch) {
+    let controller = await routeMatch.data();
+
+    // Endpoint-declared access (spec: EndpointAccess). A 'public' declaration
+    // opts that one endpoint out of the router's authentication gate; the
+    // handler still receives the resolved caller identity when the request
+    // presents verifiable credentials.
+    const declaredPublic = getEndpointAccess(controller) === 'public';
+
     // Check if authentication is required for this route
-    const publicRoute = isPublicApiRoute(routePath, request, env);
+    const publicRoute = declaredPublic || isPublicApiRoute(routePath, request, env);
     const isApiRoute = routePath.startsWith('/api/');
 
     let authContext = null;
@@ -7656,10 +7666,24 @@ ${packedThreadRouteCode}
           threadAccess = { threadId, thread };
         }
       }
+    } else if (isApiRoute && declaredPublic) {
+      // Optional caller resolution for endpoint-declared public routes:
+      // verifiable credentials attribute the request, anything else stays
+      // anonymous instead of being rejected (spec ThreadEndpointAuth).
+      authContext = await authenticate(request, env);
+      if (authContext && routePath.startsWith('/api/threads/')) {
+        const threadId = routeMatch.params?.threadId || routeMatch.params?.id;
+        if (threadId) {
+          const agentBuilderId = env.AGENT_BUILDER.idFromName('singleton');
+          const agentBuilder = env.AGENT_BUILDER.get(agentBuilderId);
+          const thread = await agentBuilder.getThread(threadId);
+          if (thread && canAccessThread(authContext, thread)) {
+            threadAccess = { threadId, thread };
+          }
+        }
+      }
     }
 
-    let controller = await routeMatch.data();
-
     // Check if this is a thread endpoint (marked by defineThreadEndpoint)
     // If so, wrap it with createThreadEndpointHandler to provide ThreadState
     if (isThreadEndpoint(controller)) {
@@ -7674,6 +7698,7 @@ ${packedThreadRouteCode}
       config,
       tools,
       auth: authContext, // Add auth context to controller context
+      caller: endpointCallerFromAuth(authContext), // Spec ControllerContext.caller
       threadAccess, // Router's thread authorization, bound to the exact id
     };
     const result = await controller(context);