@standardagents/builder 0.41.6 → 0.41.8

package/dist/built-in-routes.js

@@ -79652,7 +79652,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.41.6".length > 0 ? "0.41.6" : "dev";
+var BUILDER_VERSION = "0.41.8".length > 0 ? "0.41.8" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -85716,6 +85716,16 @@ var analyze_get_default2 = defineController2(async ({ req, env: env2 }) => {
 });
 
 // src/users/dispatch.ts
+function userValueStore(env2, userId) {
+  const hub = env2.AGENT_BUILDER_USER_HUB;
+  if (hub) return hub.get(hub.idFromName(userId));
+  const singleton = env2.AGENT_BUILDER;
+  if (!singleton) return null;
+  return singleton.get(singleton.idFromName("singleton"));
+}
+function validUserValueKey(key) {
+  return typeof key === "string" && key.length > 0 && key.length <= 512;
+}
 function userHubStub(env2, userId) {
   const namespace = env2.AGENT_BUILDER_USER_HUB;
   if (!namespace) return null;
@@ -85740,8 +85750,9 @@ async function forwardToUserScope(req, env2, userId, scopePath, channel = "user"
 }
 
 // src/api/users/[id]/[...rest].ts
-var rest_default = defineController2(async ({ req, env: env2, params }) => {
-  const authResult = await requireAuth(req, env2);
+var rest_default = defineController2(async (context) => {
+  const { req, env: env2, params } = context;
+  const authResult = await resolveRequestAuth(context);
   if (authResult instanceof Response) return authResult;
   const isAdmin = authResult.authType === "super_admin" || authResult.user?.role === "admin";
   if (!isAdmin) {
@@ -85828,6 +85839,25 @@ var env_patch_default = defineController2(async ({ req, env: env2, params }) =>
   }
 });
 
+// src/api/users/[id]/grants/index.get.ts
+var index_get_default4 = defineController2(async ({ req, env: env2, params }) => {
+  const auth = await requireAdmin(req, env2);
+  if (auth instanceof Response) return auth;
+  const userId = params.id;
+  if (!userId) return Response.json({ error: "User ID is required" }, { status: 400 });
+  const builder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  if (!await builder.getUserById(userId)) {
+    return Response.json({ error: "User not found" }, { status: 404 });
+  }
+  if (!env2.AGENT_BUILDER_USER_HUB) {
+    return Response.json({ error: "The user scope is not available on this runtime" }, { status: 500 });
+  }
+  const hub = env2.AGENT_BUILDER_USER_HUB.get(
+    env2.AGENT_BUILDER_USER_HUB.idFromName(userId)
+  );
+  return Response.json({ grants: await hub.listGrants(userId) });
+});
+
 // src/api/users/[id]/stream.ts
 var stream_default2 = defineController2(async (context) => {
   const { req, env: env2, params } = context;
@@ -86173,8 +86203,9 @@ var start_get_default = defineController2(async ({ req, env: env2 }) => {
 });
 
 // src/api/users/me/[...rest].ts
-var rest_default2 = defineController2(async ({ req, env: env2, params }) => {
-  const authResult = await requireAuth(req, env2);
+var rest_default2 = defineController2(async (context) => {
+  const { req, env: env2, params } = context;
+  const authResult = await resolveRequestAuth(context);
   if (authResult instanceof Response) return authResult;
   if (authResult.authType === "super_admin") {
     return Response.json(
@@ -86274,7 +86305,7 @@ var hub_default = defineController2(async (context) => {
   if (req.headers.get("upgrade")?.toLowerCase() !== "websocket") {
     return Response.json(
       { error: "This endpoint only supports WebSocket connections" },
-      { status: 400 }
+      { status: 426 }
     );
   }
   const namespace = env2.AGENT_BUILDER_USER_HUB;
@@ -86299,9 +86330,10 @@ var hub_default = defineController2(async (context) => {
 });
 
 // src/api/users/me/kv/index.delete.ts
-var index_delete_default = defineController2(async ({ req, env: env2 }) => {
+var index_delete_default = defineController2(async (context) => {
+  const { req, env: env2 } = context;
   try {
-    const authResult = await requireAuth(req, env2);
+    const authResult = await resolveRequestAuth(context);
     if (authResult instanceof Response) {
       return authResult;
     }
@@ -86313,19 +86345,18 @@ var index_delete_default = defineController2(async ({ req, env: env2 }) => {
     }
     const url = new URL(req.url);
     const key = url.searchParams.get("key");
-    if (!key) {
-      return Response.json({ error: "key query parameter required" }, { status: 400 });
+    if (!validUserValueKey(key)) {
+      return Response.json({ error: "key query parameter required (1 to 512 characters)" }, { status: 400 });
     }
     if (!isUserKvKeyClientWritable(key)) return reservedKvKeyResponse();
-    const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
-    const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
-    if (typeof agentBuilder.setUserValue !== "function") {
+    const store = userValueStore(env2, authResult.user.id);
+    if (!store) {
       return Response.json(
         { error: "User value storage is not supported by this runtime" },
         { status: 500 }
       );
     }
-    await agentBuilder.setUserValue(authResult.user.id, key, null);
+    await store.setUserValue(authResult.user.id, key, null);
     return Response.json({ status: "ok", key });
   } catch (error) {
     console.error("Delete user kv error:", error);
@@ -86337,9 +86368,10 @@ var index_delete_default = defineController2(async ({ req, env: env2 }) => {
 });
 
 // src/api/users/me/kv/index.get.ts
-var index_get_default4 = defineController2(async ({ req, env: env2 }) => {
+var index_get_default5 = defineController2(async (context) => {
+  const { req, env: env2 } = context;
   try {
-    const authResult = await requireAuth(req, env2);
+    const authResult = await resolveRequestAuth(context);
     if (authResult instanceof Response) {
       return authResult;
     }
@@ -86350,28 +86382,24 @@ var index_get_default4 = defineController2(async ({ req, env: env2 }) => {
       );
     }
     const url = new URL(req.url);
-    const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
-    const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
-    const key = url.searchParams.get("key");
-    if (key) {
-      if (typeof agentBuilder.getUserValue !== "function") {
-        return Response.json(
-          { error: "User value storage is not supported by this runtime" },
-          { status: 500 }
-        );
-      }
-      const value = await agentBuilder.getUserValue(authResult.user.id, key);
-      return Response.json({ key, value });
-    }
-    if (typeof agentBuilder.listUserValues !== "function") {
+    const store = userValueStore(env2, authResult.user.id);
+    if (!store) {
       return Response.json(
         { error: "User value storage is not supported by this runtime" },
         { status: 500 }
       );
     }
+    const key = url.searchParams.get("key");
+    if (key !== null) {
+      if (!validUserValueKey(key)) {
+        return Response.json({ error: "key must be 1 to 512 characters" }, { status: 400 });
+      }
+      const value = await store.getUserValue(authResult.user.id, key);
+      return Response.json({ key, value });
+    }
     const limitParam = Number.parseInt(url.searchParams.get("limit") ?? "", 10);
     const offsetParam = Number.parseInt(url.searchParams.get("offset") ?? "", 10);
-    const result = await agentBuilder.listUserValues(authResult.user.id, {
+    const result = await store.listUserValues(authResult.user.id, {
       prefix: url.searchParams.get("prefix"),
       limit: Number.isFinite(limitParam) ? limitParam : void 0,
       offset: Number.isFinite(offsetParam) ? offsetParam : void 0
@@ -86387,9 +86415,10 @@ var index_get_default4 = defineController2(async ({ req, env: env2 }) => {
 });
 
 // src/api/users/me/kv/index.post.ts
-var index_post_default7 = defineController2(async ({ req, env: env2 }) => {
+var index_post_default7 = defineController2(async (context) => {
+  const { req, env: env2 } = context;
   try {
-    const authResult = await requireAuth(req, env2);
+    const authResult = await resolveRequestAuth(context);
     if (authResult instanceof Response) {
       return authResult;
     }
@@ -86410,19 +86439,18 @@ var index_post_default7 = defineController2(async ({ req, env: env2 }) => {
       return Response.json({ error: "Invalid JSON body" }, { status: 400 });
     }
     const key = body.key;
-    if (typeof key !== "string" || key.length === 0) {
-      return Response.json({ error: "key required" }, { status: 400 });
+    if (!validUserValueKey(key)) {
+      return Response.json({ error: "key required (1 to 512 characters)" }, { status: 400 });
     }
     if (!isUserKvKeyClientWritable(key)) return reservedKvKeyResponse();
-    const agentBuilderId = env2.AGENT_BUILDER.idFromName("singleton");
-    const agentBuilder = env2.AGENT_BUILDER.get(agentBuilderId);
-    if (typeof agentBuilder.setUserValue !== "function") {
+    const store = userValueStore(env2, authResult.user.id);
+    if (!store) {
       return Response.json(
         { error: "User value storage is not supported by this runtime" },
         { status: 500 }
       );
     }
-    await agentBuilder.setUserValue(authResult.user.id, key, body.value ?? null);
+    await store.setUserValue(authResult.user.id, key, body.value ?? null);
     return Response.json({ status: "ok", key });
   } catch (error) {
     console.error("Set user kv error:", error);
@@ -87484,6 +87512,124 @@ var requestId_post_default = defineController2(async ({ req, params, env: env2 }
   }
 });
 
+// src/api/users/[id]/grants/[name].delete.ts
+var name_delete_default2 = defineController2(async ({ req, env: env2, params }) => {
+  const auth = await requireAdmin(req, env2);
+  if (auth instanceof Response) return auth;
+  const userId = params.id;
+  const name15 = params.name;
+  if (!userId || !name15) return Response.json({ error: "User ID and grant name are required" }, { status: 400 });
+  const builder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  if (!await builder.getUserById(userId)) {
+    return Response.json({ error: "User not found" }, { status: 404 });
+  }
+  if (!env2.AGENT_BUILDER_USER_HUB) {
+    return Response.json({ error: "The user scope is not available on this runtime" }, { status: 500 });
+  }
+  const hub = env2.AGENT_BUILDER_USER_HUB.get(
+    env2.AGENT_BUILDER_USER_HUB.idFromName(userId)
+  );
+  await hub.deleteGrant(userId, name15);
+  return new Response(null, { status: 204 });
+});
+var GRANT_NAME = /^[a-z0-9][a-z0-9._-]{0,127}$/;
+var HEADER_NAME = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var QUERY_NAME = /^[A-Za-z0-9._~-]{1,128}$/;
+var SUPPORTED_KINDS = /* @__PURE__ */ new Set(["bearer", "header", "query", "basic"]);
+var RECORD_KEYS = /* @__PURE__ */ new Set(["name", "kind", "origins", "inject", "allow", "metadata", "secret"]);
+var ALLOW_KEYS = /* @__PURE__ */ new Set(["tools", "endpoints", "userEndpoints", "agents"]);
+var INJECT_KEYS = /* @__PURE__ */ new Set(["header", "format", "query"]);
+function validateCredentialGrantRecord(value, routeName) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const input = value;
+  if (Object.keys(input).some((key) => !RECORD_KEYS.has(key))) return null;
+  const name15 = routeName ?? input.name;
+  if (typeof name15 !== "string" || !GRANT_NAME.test(name15)) return null;
+  if (input.name !== void 0 && input.name !== name15) return null;
+  if (typeof input.secret !== "string" || input.secret.length === 0 || input.secret.length > 16 * 1024) return null;
+  if (typeof input.kind !== "string" || !SUPPORTED_KINDS.has(input.kind)) return null;
+  if ((input.kind === "bearer" || input.kind === "header") && /[\r\n]/.test(input.secret)) return null;
+  if (!Array.isArray(input.origins) || input.origins.length === 0 || input.origins.length > 64) return null;
+  const origins = [];
+  for (const origin of input.origins) {
+    if (typeof origin !== "string" || origin.length > 512) return null;
+    if (origin.startsWith("*.")) {
+      if (!/^\*\.[a-z0-9.-]+$/i.test(origin)) return null;
+    } else {
+      try {
+        const url = new URL(origin);
+        if (url.origin !== origin || url.protocol !== "https:" || url.username || url.password) return null;
+      } catch {
+        return null;
+      }
+    }
+    origins.push(origin);
+  }
+  if (!input.allow || typeof input.allow !== "object" || Array.isArray(input.allow)) return null;
+  const allowInput = input.allow;
+  if (Object.keys(allowInput).some((key) => !ALLOW_KEYS.has(key))) return null;
+  const allow = {};
+  for (const key of ["tools", "endpoints", "userEndpoints", "agents"]) {
+    const list = allowInput[key];
+    if (list === void 0) continue;
+    if (!Array.isArray(list) || list.length > 128 || !list.every((item) => typeof item === "string" && item.length > 0 && item.length <= 256)) {
+      return null;
+    }
+    allow[key] = [...list];
+  }
+  if (Object.keys(allow).length === 0) return null;
+  const inject = input.inject;
+  if (inject !== void 0 && (!inject || typeof inject !== "object" || Array.isArray(inject))) return null;
+  if (inject !== void 0) {
+    const injection = inject;
+    if (Object.keys(injection).some((key) => !INJECT_KEYS.has(key))) return null;
+    if (injection.header !== void 0 && (typeof injection.header !== "string" || !HEADER_NAME.test(injection.header))) return null;
+    if (injection.format !== void 0 && (typeof injection.format !== "string" || injection.format.length > 1024 || /[\r\n]/.test(injection.format))) return null;
+    if (injection.query !== void 0 && (typeof injection.query !== "string" || !QUERY_NAME.test(injection.query))) return null;
+  }
+  const metadata = input.metadata;
+  if (metadata !== void 0 && (!metadata || typeof metadata !== "object" || Array.isArray(metadata))) return null;
+  if (metadata !== void 0) {
+    try {
+      if (JSON.stringify(metadata).length > 16 * 1024) return null;
+    } catch {
+      return null;
+    }
+  }
+  const grant = {
+    name: name15,
+    kind: input.kind,
+    origins,
+    allow,
+    ...inject === void 0 ? {} : { inject },
+    ...metadata === void 0 ? {} : { metadata }
+  };
+  return { grant, secret: input.secret };
+}
+
+// src/api/users/[id]/grants/[name].put.ts
+var name_put_default = defineController2(async ({ req, env: env2, params }) => {
+  const auth = await requireAdmin(req, env2);
+  if (auth instanceof Response) return auth;
+  const userId = params.id;
+  const name15 = params.name;
+  if (!userId || !name15) return Response.json({ error: "User ID and grant name are required" }, { status: 400 });
+  const record24 = validateCredentialGrantRecord(await req.json().catch(() => null), name15);
+  if (!record24) return Response.json({ error: "Invalid credential grant" }, { status: 400 });
+  const builder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
+  if (!await builder.getUserById(userId)) {
+    return Response.json({ error: "User not found" }, { status: 404 });
+  }
+  if (!env2.AGENT_BUILDER_USER_HUB) {
+    return Response.json({ error: "The user scope is not available on this runtime" }, { status: 500 });
+  }
+  const hub = env2.AGENT_BUILDER_USER_HUB.get(
+    env2.AGENT_BUILDER_USER_HUB.idFromName(userId)
+  );
+  await hub.setGrant(userId, record24.grant, record24.secret);
+  return new Response(null, { status: 204 });
+});
+
 // src/api/threads/[id]/effects/[effectId]/cancel.post.ts
 async function getAuthorizedThreadStub3(req, env2, threadId) {
   const authResult = await requireAuth(req, env2);
@@ -87949,6 +88095,7 @@ var routeHandlers = {
   "GET:/users/:id/**": rest_default,
   "GET:/users/:id/env": env_get_default,
   "PATCH:/users/:id/env": env_patch_default,
+  "GET:/users/:id/grants": index_get_default4,
   "GET:/users/:id/stream": stream_default2,
   "GET:/variables/agents/:name": name_get_default6,
   "GET:/variables/prompts/:name": name_get_default7,
@@ -87965,7 +88112,7 @@ var routeHandlers = {
   "PATCH:/users/me/env": env_patch_default2,
   "GET:/users/me/hub": hub_default,
   "DELETE:/users/me/kv": index_delete_default,
-  "GET:/users/me/kv": index_get_default4,
+  "GET:/users/me/kv": index_get_default5,
   "POST:/users/me/kv": index_post_default7,
   "GET:/users/me/stream": stream_default3,
   "GET:/auth/device/:code/approve": approve_get_default,
@@ -87979,6 +88126,8 @@ var routeHandlers = {
   "PATCH:/threads/:id/messages/:messageId": messageId_patch_default,
   "GET:/threads/:id/variables/:requestId": requestId_get_default,
   "POST:/threads/:id/variables/:requestId": requestId_post_default,
+  "DELETE:/users/:id/grants/:name": name_delete_default2,
+  "PUT:/users/:id/grants/:name": name_put_default,
   "POST:/threads/:id/effects/:effectId/cancel": cancel_post_default,
   "POST:/threads/:id/effects/:effectId/run": run_post_default,
   "GET:/threads/:id/logs/:logId/inspect/:provider": provider_get_default