@standardagents/builder 0.41.6 → 0.41.8

package/dist/packing.d.ts

@@ -1,6 +1,6 @@
-import { P as PackingAnalysis, a as PackingOptions, b as PackingResult, U as UnpackAnalysis, c as UnpackOptions, d as UnpackResult } from './types-D1ABHvAH.js';
-export { D as DiscoveredPackage } from './types-D1ABHvAH.js';
-export { P as PackageDiscoveryService, d as discoverPackages } from './discovery-CIGNVJfG.js';
+import { P as PackingAnalysis, a as PackingOptions, b as PackingResult, d as UnpackAnalysis, U as UnpackOptions, c as UnpackResult } from './types-Dhd0M369.js';
+export { D as DiscoveredPackage } from './types-Dhd0M369.js';
+export { P as PackageDiscoveryService, d as discoverPackages } from './discovery-D5pmuazY.js';
 import '@standardagents/spec';
 
 /**

package/dist/plugin.js

@@ -7891,6 +7891,8 @@ import {
   applyRuntimeCors,
   runtimeCorsHeaders,
   runtimePreflightResponse,
+  formatUpstreamTiming,
+  withUpstreamTiming,
 } from "@standardagents/builder/runtime";
 import { isThreadEndpoint, getEndpointAccess } from "@standardagents/spec";
 
@@ -8015,13 +8017,19 @@ ${packedThreadRouteCode}
     // thread id, for same-request reuse by controllers (AB-05). Never cached
     // across requests.
     let threadAccess = null;
+    // The request handed to the controller. A protected API request carries
+    // x-standard-upstream-timing with the authentication cost; the header is
+    // overwritten, never merged, so a caller cannot forge upstream time.
+    let controllerRequest = request;
 
     // Require authentication for all API routes except public ones.
     // WebSocket tickets are single-use and are consumed here. Controllers
     // must reuse context.auth (resolveRequestAuth) rather than calling
     // requireAuth again, or a ticket-only upgrade will 401.
     if (isApiRoute && !publicRoute) {
+      const authStartedAt = Date.now();
       const authResult = await requireAuth(request, env);
+      controllerRequest = withUpstreamTiming(request, formatUpstreamTiming('auth', Date.now() - authStartedAt));
 
       // If requireAuth returns a Response, it's an error (401)
       if (authResult instanceof Response) {
@@ -8078,7 +8086,7 @@ ${packedThreadRouteCode}
     }
 
     const context = {
-      req: request,
+      req: controllerRequest,
       params: routeMatch.params || {},
       env: env,
       url: url,