@standardagents/builder 0.41.14 → 0.41.16

package/dist/plugin.d.ts

@@ -1,5 +1,19 @@
 import { PluginOption } from 'vite';
 
+/**
+ * Cross-deployment API key exchange: which sibling deployments an instance
+ * trusts to vouch for a user. A project lists them once in `builder()`, so
+ * production and every preview deployment of that project share the list.
+ */
+interface KeyExchangeOptions {
+    /**
+     * Origins whose API keys this instance accepts in exchange for its own.
+     * Each entry is an exact `https://host` origin or `https://*.suffix`, which
+     * matches any host strictly beneath that suffix.
+     */
+    trustedOrigins: string[];
+}
+
 interface DeviceApprovalBrand {
     /** Customer-facing product or instance name. */
     name: string;
@@ -31,6 +45,12 @@ interface AgentPluginOptions {
     providers?: string[];
     /** Presentation used by the built-in device sign-in confirmation page. */
     deviceApproval?: DeviceApprovalBrand;
+    /**
+     * Sibling deployments of this project (production and its previews) whose
+     * API keys `POST /api/auth/exchange` accepts in exchange for a key on this
+     * instance. Absent disables the exchange.
+     */
+    keyExchange?: KeyExchangeOptions;
     /**
      * Exact additional hostnames trusted for local authoring APIs.
      * Anyone who can reach the dev server through one of these names can attempt
@@ -42,4 +62,4 @@ interface AgentPluginOptions {
 declare function agentbuilder(options?: AgentPluginOptions): PluginOption[];
 declare const builder: typeof agentbuilder;
 
-export { type AgentPluginOptions, type DeviceApprovalBrand, agentbuilder, builder };
+export { type AgentPluginOptions, type DeviceApprovalBrand, type KeyExchangeOptions, agentbuilder, builder };

package/dist/plugin.js

@@ -8202,7 +8202,8 @@ async function loadVirtualModule(id, context) {
     installedProviders,
     rou3Code,
     hmr,
-    deviceApproval
+    deviceApproval,
+    keyExchange
   } = context;
   if (id === RESOLVED_VIRTUAL_TOOLS_ID) {
     const tools = await scanToolsDirectory(toolsDir);
@@ -8267,6 +8268,7 @@ export const config = {
   promptsDir: "${relativePromptsDir}",
   agentsDir: "${relativeAgentsDir}",
   deviceApproval: ${JSON.stringify(deviceApproval ?? null)},
+  keyExchange: ${JSON.stringify(keyExchange ?? null)},
 };`;
   }
   if (id === RESOLVED_VIRTUAL_MODELS_ID) {
@@ -8675,6 +8677,35 @@ function applyPluginEnvironmentConfig(config, options = {}) {
   }
 }
 
+// src/utils/key-exchange.ts
+var HOST_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function validHost(host) {
+  return host.length <= 253 && host.split(".").length >= 2 && host.split(".").every((label) => HOST_LABEL.test(label));
+}
+function normalizeTrustedOrigin(value) {
+  if (typeof value !== "string") {
+    throw new Error("keyExchange.trustedOrigins entries must be strings");
+  }
+  const entry = value.trim().toLowerCase();
+  const host = entry.startsWith("https://") ? entry.slice("https://".length) : "";
+  const wildcard = host.startsWith("*.");
+  if (!validHost(wildcard ? host.slice(2) : host)) {
+    throw new Error(`keyExchange.trustedOrigins entry ${JSON.stringify(value)} must be https://host or https://*.suffix`);
+  }
+  return entry;
+}
+function normalizeKeyExchange(value) {
+  if (value === void 0) return void 0;
+  if (!value || typeof value !== "object" || !Array.isArray(value.trustedOrigins)) {
+    throw new Error("keyExchange must be an object with a trustedOrigins array");
+  }
+  const trustedOrigins = [...new Set(value.trustedOrigins.map(normalizeTrustedOrigin))];
+  if (trustedOrigins.length === 0) {
+    throw new Error("keyExchange.trustedOrigins must name at least one origin");
+  }
+  return { trustedOrigins };
+}
+
 // src/plugin/device-approval.ts
 function requiredText(value, field, maxLength) {
   if (typeof value !== "string" || !value.trim() || value.trim().length > maxLength) {
@@ -8719,6 +8750,7 @@ function normalizeDeviceApprovalBrand(value) {
 // src/plugin.ts
 function agentbuilder(options = {}) {
   const deviceApproval = normalizeDeviceApprovalBrand(options.deviceApproval);
+  const keyExchange = normalizeKeyExchange(options.keyExchange);
   const trustedDevHosts = normalizeTrustedDevHosts(options.trustedDevHosts);
   const toolsDir = options.toolsDir ? path9__default.resolve(process.cwd(), options.toolsDir) : path9__default.resolve(process.cwd(), "agents/tools");
   const hooksDir = options.hooksDir ? path9__default.resolve(process.cwd(), options.hooksDir) : path9__default.resolve(process.cwd(), "agents/hooks");
@@ -8815,7 +8847,8 @@ export { CodeExecutionBridge, DurableAgentBuilder, DurableThread, ThreadWatchdog
     installedProviders,
     rou3Code,
     hmr,
-    deviceApproval
+    deviceApproval,
+    keyExchange
   };
   const devMiddlewareContext = {
     toolsDir,