@standardagents/builder 0.41.14 → 0.41.16

package/dist/built-in-routes.js

@@ -56454,6 +56454,48 @@ var init_dist7 = __esm({
        * OpenAI doesn't provide a capabilities API, so these are manually maintained.
        */
       static MODEL_CAPABILITIES = {
+        // GPT-6 family (catalog synced 2026-10-01): 1,048,576-token context,
+        // 128k output, text + image input, reasoning efforts low..max (Luna also
+        // accepts `none`). The 0-100 reasoning scale maps onto the low/medium/high
+        // vocabulary the builder validates; `max` and `none` are not expressible
+        // through reasoningLevels yet. Listed before older entries because
+        // lookup is first-prefix-match over insertion order.
+        "gpt-6.1-sol": {
+          supportsImages: true,
+          supportsToolCalls: true,
+          supportsStreaming: true,
+          supportsJsonMode: true,
+          maxContextTokens: 1048576,
+          maxOutputTokens: 128e3,
+          reasoningLevels: { 0: null, 33: "low", 66: "medium", 100: "high" }
+        },
+        "gpt-6-astra": {
+          supportsImages: true,
+          supportsToolCalls: true,
+          supportsStreaming: true,
+          supportsJsonMode: true,
+          maxContextTokens: 1048576,
+          maxOutputTokens: 128e3,
+          reasoningLevels: { 0: null, 33: "low", 66: "medium", 100: "high" }
+        },
+        "gpt-6-sol": {
+          supportsImages: true,
+          supportsToolCalls: true,
+          supportsStreaming: true,
+          supportsJsonMode: true,
+          maxContextTokens: 1048576,
+          maxOutputTokens: 128e3,
+          reasoningLevels: { 0: null, 33: "low", 66: "medium", 100: "high" }
+        },
+        "gpt-6-luna": {
+          supportsImages: true,
+          supportsToolCalls: true,
+          supportsStreaming: true,
+          supportsJsonMode: true,
+          maxContextTokens: 1048576,
+          maxOutputTokens: 128e3,
+          reasoningLevels: { 0: null, 33: "low", 66: "medium", 100: "high" }
+        },
         "gpt-4o": {
           supportsImages: true,
           supportsToolCalls: true,
@@ -56567,6 +56609,10 @@ var init_dist7 = __esm({
        * Used to enrich API response data.
        */
       static MODEL_METADATA = {
+        "gpt-6.1-sol": { name: "GPT-6.1 Sol", description: "Updated GPT-6 Sol with 1M context, vision, and reasoning" },
+        "gpt-6-astra": { name: "GPT-6 Astra", description: "Highest-capability GPT-6 model with 1M context" },
+        "gpt-6-sol": { name: "GPT-6 Sol", description: "Flagship GPT-6 model with 1M context, vision, and reasoning" },
+        "gpt-6-luna": { name: "GPT-6 Luna", description: "Fast, low-cost GPT-6 model with 1M context" },
         "gpt-4o": { name: "GPT-4o", description: "Most capable GPT-4 model with vision" },
         "gpt-4o-mini": { name: "GPT-4o Mini", description: "Fast and affordable GPT-4o variant" },
         "gpt-4-turbo": { name: "GPT-4 Turbo", description: "GPT-4 Turbo with vision" },
@@ -79652,7 +79698,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.41.14".length > 0 ? "0.41.14" : "dev";
+var BUILDER_VERSION = "0.41.16".length > 0 ? "0.41.16" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -82063,6 +82109,101 @@ function authRateLimitedResponse(result) {
   );
 }
 
+// src/utils/key-exchange.ts
+var HOST_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function validHost(host) {
+  return host.length <= 253 && host.split(".").length >= 2 && host.split(".").every((label) => HOST_LABEL.test(label));
+}
+function canonicalSourceOrigin(value) {
+  if (typeof value !== "string" || value.length > 300) return null;
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.port || parsed.search || parsed.hash || parsed.pathname !== "/" && parsed.pathname !== "" || !validHost(parsed.hostname) || value.replace(/\/$/, "") !== parsed.origin) {
+    return null;
+  }
+  return parsed.origin;
+}
+function isTrustedOrigin(origin, trustedOrigins) {
+  const host = origin.slice("https://".length);
+  return trustedOrigins.some((entry) => {
+    const trusted = entry.slice("https://".length);
+    return trusted.startsWith("*.") ? host.endsWith(trusted.slice(1)) && host.length > trusted.length - 1 : host === trusted;
+  });
+}
+
+// src/api/auth/exchange.post.ts
+var ADDRESS_LIMIT = { limit: 30, window_seconds: 60 * 60 };
+var SOURCE_TIMEOUT_MS = 5e3;
+function refused(status, error, message) {
+  return Response.json({ error, message }, { status, headers: { "Cache-Control": "no-store" } });
+}
+var exchange_post_default = defineController2(async ({ req, env: env2, config }) => {
+  const trustedOrigins = config?.keyExchange?.trustedOrigins;
+  if (!trustedOrigins?.length) {
+    return refused(404, "key_exchange_unsupported", "This instance does not exchange keys.");
+  }
+  const body = await req.json().catch(() => null);
+  const sourceOrigin = canonicalSourceOrigin(body?.source_origin);
+  const sourceKey = typeof body?.source_key === "string" ? body.source_key.trim() : "";
+  if (!sourceOrigin || !sourceKey || sourceKey.length > 512) {
+    return refused(400, "invalid_request", "source_origin and source_key are required.");
+  }
+  if (sourceOrigin === new URL(req.url).origin || !isTrustedOrigin(sourceOrigin, trustedOrigins)) {
+    return refused(403, "untrusted_origin", "This instance does not trust that origin.");
+  }
+  const agentBuilder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  const addressLimit = await agentBuilder.consumeAuthRateLimit({
+    key: await authRateLimitKey("key-exchange-address", authClientAddress(req)),
+    ...ADDRESS_LIMIT
+  });
+  if (!addressLimit.allowed) return authRateLimitedResponse(addressLimit);
+  let identity;
+  try {
+    const response = await fetch(`${sourceOrigin}/api/auth/me`, {
+      headers: { Authorization: `Bearer ${sourceKey}`, Accept: "application/json" },
+      redirect: "manual",
+      signal: AbortSignal.timeout(SOURCE_TIMEOUT_MS)
+    });
+    if (response.status === 401 || response.status === 403) {
+      return refused(401, "source_key_rejected", "The source deployment rejected the key.");
+    }
+    if (!response.ok) {
+      return refused(502, "source_unavailable", `The source deployment answered ${response.status}.`);
+    }
+    identity = await response.json();
+  } catch {
+    return refused(502, "source_unavailable", "The source deployment could not be reached.");
+  }
+  if (identity?.authType !== "api_key") {
+    return refused(401, "source_key_rejected", "Only API keys can be exchanged.");
+  }
+  const platformUserId = identity.user?.platform_user_id;
+  if (typeof platformUserId !== "string" || !platformUserId) {
+    return refused(403, "unknown_user", "The key does not belong to a platform user.");
+  }
+  const user = await agentBuilder.getUserByPlatformUserId(platformUserId);
+  if (!user) {
+    return refused(403, "unknown_user", "That user has not signed in to this instance.");
+  }
+  const token = generateApiKey();
+  const sourceHost = new URL(sourceOrigin).hostname;
+  await agentBuilder.createApiKey({
+    name: `Key exchange from ${sourceHost}`.slice(0, 100),
+    key_hash: await hashToken(token),
+    key_prefix: getTokenPrefix(token),
+    last_five: getLastChars(token, 5),
+    user_id: user.id
+  });
+  return Response.json(
+    { token, endpoint: new URL(req.url).origin, user: { id: user.id, username: user.username } },
+    { status: 201, headers: { "Cache-Control": "no-store" } }
+  );
+});
+
 // src/api/auth/login.post.ts
 var LOGIN_ADDRESS_LIMIT = { limit: 10, window_seconds: 5 * 60 };
 var LOGIN_IDENTITY_LIMIT = { limit: 25, window_seconds: 15 * 60 };
@@ -88033,6 +88174,7 @@ var routeHandlers = {
   "POST:/auth/brolly-control": brolly_control_post_default,
   "GET:/auth/config": config_get_default2,
   "DELETE:/auth/current-key": current_key_delete_default,
+  "POST:/auth/exchange": exchange_post_default,
   "POST:/auth/login": login_post_default,
   "POST:/auth/logout": logout_post_default,
   "GET:/auth/me": me_get_default,