@standardagents/builder 0.41.6 → 0.41.7

package/dist/built-in-routes.js

@@ -79652,7 +79652,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.41.6".length > 0 ? "0.41.6" : "dev";
+var BUILDER_VERSION = "0.41.7".length > 0 ? "0.41.7" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -85828,6 +85828,25 @@ var env_patch_default = defineController2(async ({ req, env: env2, params }) =>
   }
 });
 
+// src/api/users/[id]/grants/index.get.ts
+var index_get_default4 = defineController2(async ({ req, env: env2, params }) => {
+  const auth = await requireAdmin(req, env2);
+  if (auth instanceof Response) return auth;
+  const userId = params.id;
+  if (!userId) return Response.json({ error: "User ID is required" }, { status: 400 });
+  const builder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  if (!await builder.getUserById(userId)) {
+    return Response.json({ error: "User not found" }, { status: 404 });
+  }
+  if (!env2.AGENT_BUILDER_USER_HUB) {
+    return Response.json({ error: "The user scope is not available on this runtime" }, { status: 500 });
+  }
+  const hub = env2.AGENT_BUILDER_USER_HUB.get(
+    env2.AGENT_BUILDER_USER_HUB.idFromName(userId)
+  );
+  return Response.json({ grants: await hub.listGrants(userId) });
+});
+
 // src/api/users/[id]/stream.ts
 var stream_default2 = defineController2(async (context) => {
   const { req, env: env2, params } = context;
@@ -86337,7 +86356,7 @@ var index_delete_default = defineController2(async ({ req, env: env2 }) => {
 });
 
 // src/api/users/me/kv/index.get.ts
-var index_get_default4 = defineController2(async ({ req, env: env2 }) => {
+var index_get_default5 = defineController2(async ({ req, env: env2 }) => {
   try {
     const authResult = await requireAuth(req, env2);
     if (authResult instanceof Response) {
@@ -87484,6 +87503,124 @@ var requestId_post_default = defineController2(async ({ req, params, env: env2 }
   }
 });
 
+// src/api/users/[id]/grants/[name].delete.ts
+var name_delete_default2 = defineController2(async ({ req, env: env2, params }) => {
+  const auth = await requireAdmin(req, env2);
+  if (auth instanceof Response) return auth;
+  const userId = params.id;
+  const name15 = params.name;
+  if (!userId || !name15) return Response.json({ error: "User ID and grant name are required" }, { status: 400 });
+  const builder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  if (!await builder.getUserById(userId)) {
+    return Response.json({ error: "User not found" }, { status: 404 });
+  }
+  if (!env2.AGENT_BUILDER_USER_HUB) {
+    return Response.json({ error: "The user scope is not available on this runtime" }, { status: 500 });
+  }
+  const hub = env2.AGENT_BUILDER_USER_HUB.get(
+    env2.AGENT_BUILDER_USER_HUB.idFromName(userId)
+  );
+  await hub.deleteGrant(userId, name15);
+  return new Response(null, { status: 204 });
+});
+var GRANT_NAME = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+var HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var QUERY_NAME = /^[A-Za-z0-9._~-]{1,128}$/;
+var SUPPORTED_KINDS = /* @__PURE__ */ new Set(["bearer", "header", "query", "basic"]);
+var RECORD_KEYS = /* @__PURE__ */ new Set(["name", "kind", "origins", "inject", "allow", "metadata", "secret"]);
+var ALLOW_KEYS = /* @__PURE__ */ new Set(["tools", "endpoints", "userEndpoints", "agents"]);
+var INJECT_KEYS = /* @__PURE__ */ new Set(["header", "format", "query"]);
+function validateCredentialGrantRecord(value, routeName) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const input = value;
+  if (Object.keys(input).some((key) => !RECORD_KEYS.has(key))) return null;
+  const name15 = routeName ?? input.name;
+  if (typeof name15 !== "string" || !GRANT_NAME.test(name15)) return null;
+  if (input.name !== void 0 && input.name !== name15) return null;
+  if (typeof input.secret !== "string" || input.secret.length === 0 || input.secret.length > 16 * 1024) return null;
+  if (typeof input.kind !== "string" || !SUPPORTED_KINDS.has(input.kind)) return null;
+  if ((input.kind === "bearer" || input.kind === "header") && /[\r\n]/.test(input.secret)) return null;
+  if (!Array.isArray(input.origins) || input.origins.length === 0 || input.origins.length > 64) return null;
+  const origins = [];
+  for (const origin of input.origins) {
+    if (typeof origin !== "string" || origin.length > 512) return null;
+    if (origin.startsWith("*.")) {
+      if (!/^\*\.[a-z0-9.-]+$/i.test(origin)) return null;
+    } else {
+      try {
+        const url = new URL(origin);
+        if (url.origin !== origin || url.protocol !== "https:" || url.username || url.password) return null;
+      } catch {
+        return null;
+      }
+    }
+    origins.push(origin);
+  }
+  if (!input.allow || typeof input.allow !== "object" || Array.isArray(input.allow)) return null;
+  const allowInput = input.allow;
+  if (Object.keys(allowInput).some((key) => !ALLOW_KEYS.has(key))) return null;
+  const allow = {};
+  for (const key of ["tools", "endpoints", "userEndpoints", "agents"]) {
+    const list = allowInput[key];
+    if (list === void 0) continue;
+    if (!Array.isArray(list) || list.length > 128 || !list.every((item) => typeof item === "string" && item.length > 0 && item.length <= 256)) {
+      return null;
+    }
+    allow[key] = [...list];
+  }
+  if (Object.keys(allow).length === 0) return null;
+  const inject = input.inject;
+  if (inject !== void 0 && (!inject || typeof inject !== "object" || Array.isArray(inject))) return null;
+  if (inject !== void 0) {
+    const injection = inject;
+    if (Object.keys(injection).some((key) => !INJECT_KEYS.has(key))) return null;
+    if (injection.header !== void 0 && (typeof injection.header !== "string" || !HEADER_NAME.test(injection.header))) return null;
+    if (injection.format !== void 0 && (typeof injection.format !== "string" || injection.format.length > 1024 || /[\r\n]/.test(injection.format))) return null;
+    if (injection.query !== void 0 && (typeof injection.query !== "string" || !QUERY_NAME.test(injection.query))) return null;
+  }
+  const metadata = input.metadata;
+  if (metadata !== void 0 && (!metadata || typeof metadata !== "object" || Array.isArray(metadata))) return null;
+  if (metadata !== void 0) {
+    try {
+      if (JSON.stringify(metadata).length > 16 * 1024) return null;
+    } catch {
+      return null;
+    }
+  }
+  const grant = {
+    name: name15,
+    kind: input.kind,
+    origins,
+    allow,
+    ...inject === void 0 ? {} : { inject },
+    ...metadata === void 0 ? {} : { metadata }
+  };
+  return { grant, secret: input.secret };
+}
+
+// src/api/users/[id]/grants/[name].put.ts
+var name_put_default = defineController2(async ({ req, env: env2, params }) => {
+  const auth = await requireAdmin(req, env2);
+  if (auth instanceof Response) return auth;
+  const userId = params.id;
+  const name15 = params.name;
+  if (!userId || !name15) return Response.json({ error: "User ID and grant name are required" }, { status: 400 });
+  const record24 = validateCredentialGrantRecord(await req.json().catch(() => null), name15);
+  if (!record24) return Response.json({ error: "Invalid credential grant" }, { status: 400 });
+  const builder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  if (!await builder.getUserById(userId)) {
+    return Response.json({ error: "User not found" }, { status: 404 });
+  }
+  if (!env2.AGENT_BUILDER_USER_HUB) {
+    return Response.json({ error: "The user scope is not available on this runtime" }, { status: 500 });
+  }
+  const hub = env2.AGENT_BUILDER_USER_HUB.get(
+    env2.AGENT_BUILDER_USER_HUB.idFromName(userId)
+  );
+  await hub.setGrant(userId, record24.grant, record24.secret);
+  return new Response(null, { status: 204 });
+});
+
 // src/api/threads/[id]/effects/[effectId]/cancel.post.ts
 async function getAuthorizedThreadStub3(req, env2, threadId) {
   const authResult = await requireAuth(req, env2);
@@ -87949,6 +88086,7 @@ var routeHandlers = {
   "GET:/users/:id/**": rest_default,
   "GET:/users/:id/env": env_get_default,
   "PATCH:/users/:id/env": env_patch_default,
+  "GET:/users/:id/grants": index_get_default4,
   "GET:/users/:id/stream": stream_default2,
   "GET:/variables/agents/:name": name_get_default6,
   "GET:/variables/prompts/:name": name_get_default7,
@@ -87965,7 +88103,7 @@ var routeHandlers = {
   "PATCH:/users/me/env": env_patch_default2,
   "GET:/users/me/hub": hub_default,
   "DELETE:/users/me/kv": index_delete_default,
-  "GET:/users/me/kv": index_get_default4,
+  "GET:/users/me/kv": index_get_default5,
   "POST:/users/me/kv": index_post_default7,
   "GET:/users/me/stream": stream_default3,
   "GET:/auth/device/:code/approve": approve_get_default,
@@ -87979,6 +88117,8 @@ var routeHandlers = {
   "PATCH:/threads/:id/messages/:messageId": messageId_patch_default,
   "GET:/threads/:id/variables/:requestId": requestId_get_default,
   "POST:/threads/:id/variables/:requestId": requestId_post_default,
+  "DELETE:/users/:id/grants/:name": name_delete_default2,
+  "PUT:/users/:id/grants/:name": name_put_default,
   "POST:/threads/:id/effects/:effectId/cancel": cancel_post_default,
   "POST:/threads/:id/effects/:effectId/run": run_post_default,
   "GET:/threads/:id/logs/:logId/inspect/:provider": provider_get_default