@standardagents/builder 0.41.7 → 0.41.8

package/dist/{discovery-CIGNVJfG.d.ts → discovery-D5pmuazY.d.ts}

@@ -1,4 +1,4 @@
-import { D as DiscoveredPackage } from './types-D1ABHvAH.js';
+import { D as DiscoveredPackage } from './types-Dhd0M369.js';
 import { ParentHookRequirement, PackageSignature } from '@standardagents/spec';
 
 /**

package/dist/{index-PSu6cMEz.d.ts → index-ChHAVogf.d.ts}

@@ -1,6 +1,6 @@
 import * as _standardagents_spec from '@standardagents/spec';
 import { ThreadState, ErrorOrigin, ToolResult as ToolResult$1, VariableDefinition, HookName, HookSignatures, HookMessage, HookToolCall, HookToolResult, CodeExecutionOptions, CodeExecutionResult, InjectMessageInput, QueueMessageInput, SubagentRegistryEntry, SubagentRelationship, PackageSignature, ProviderUsagePricing, ThreadUser, AgentDefinition, SkillMetadata, SkillFileInput, ControllerContext, Controller, ThreadEndpointHandler } from '@standardagents/spec';
-import { N as NamespacedRegistry } from './types-D1ABHvAH.js';
+import { N as NamespacedRegistry } from './types-Dhd0M369.js';
 import { DurableObjectStorage } from '@cloudflare/workers-types';
 import { ZodObject, ZodRawShape } from 'zod';
 
@@ -1979,4 +1979,4 @@ declare function defineController<Env extends ThreadEnv = ThreadEnv>(controller:
  */
 declare function createThreadEndpointHandler<Env extends ThreadEnv = ThreadEnv>(handler: ThreadEndpointHandler): BuilderController<Env>;
 
-export { type AuthUser as A, type BuilderController as B, CLIENT_STREAM_CHUNK_BYTES as C, type FlowResult as D, type TelemetryEvent as E, type FlowState as F, type Env as G, type FileRecord as H, type ImageMetadata as I, type AttachmentRef as J, type GrepResult as K, type LLMResponse as L, type Message as M, type FileStats as N, type TextContentPart as O, type ImageContentPart as P, type MultimodalContent as Q, type RequestContext as R, type StorageBackend as S, type ToolCall as T, type MessageContent as U, type ProxyStreamReceiver as V, type ProxyStreamFrame as W, type ProxyStreamTarget as X, type ProxyStreamOpenResult as Y, type SkillStorageScope as Z, type BuilderControllerContext as a, type ThreadEndpointContext as b, createThreadEndpointHandler as c, defineController as d, type ThreadEnv as e, type BuilderThreadEndpointHandler as f, authenticate as g, requireAdmin as h, endpointCallerFromAuth as i, type AuthContext as j, callClient as k, callClientStream as l, encodeStreamChunk as m, decodeStreamChunk as n, type ClientToolRequest as o, type ClientToolResponse as p, type ClientStreamRequest as q, requireAuth as r, supportsClientForwarding as s, type ClientStreamResponse as t, type ClientDuplex as u, type ClientForwarding as v, type Agent as w, type ThreadInstance as x, type ThreadMetadata as y, type ToolResult as z };
+export { type AuthUser as A, type BuilderController as B, CLIENT_STREAM_CHUNK_BYTES as C, type FlowResult as D, type TelemetryEvent as E, type FlowState as F, type Env as G, type FileRecord as H, type ImageMetadata as I, type AttachmentRef as J, type GrepResult as K, type LLMResponse as L, type Message as M, type FileStats as N, type TextContentPart as O, type ImageContentPart as P, type MultimodalContent as Q, type RequestContext as R, type StorageBackend as S, type ThreadEndpointContext as T, type MessageContent as U, type ProxyStreamReceiver as V, type ProxyStreamFrame as W, type ProxyStreamTarget as X, type ProxyStreamOpenResult as Y, type SkillStorageScope as Z, type BuilderControllerContext as a, type ThreadEnv as b, createThreadEndpointHandler as c, defineController as d, type BuilderThreadEndpointHandler as e, authenticate as f, requireAdmin as g, endpointCallerFromAuth as h, type AuthContext as i, callClient as j, callClientStream as k, encodeStreamChunk as l, decodeStreamChunk as m, type ClientToolRequest as n, type ClientToolResponse as o, type ClientStreamRequest as p, type ClientStreamResponse as q, requireAuth as r, supportsClientForwarding as s, type ClientDuplex as t, type ClientForwarding as u, type Agent as v, type ThreadInstance as w, type ThreadMetadata as x, type ToolCall as y, type ToolResult as z };

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { ModelDefinition, AgentDefinition } from './runtime.js';
-export { AgentBuilderEnv, AgentBuilderEvent, BroadcastOptions, CodeExecutionBridge, DurableAgentBuilder, DurableThread, DurableUserHub, FlowStateSdk, FlowStateWithSdk, HandlerSide, HubClientInfo, HumanSide, ImageContextConfig, InjectMessageOptions, LLMProviderInterface, NamespaceResolutionError, PromptContent, PromptDefinition, PromptIncludePart, PromptPart, PromptSide, PromptToolConfig, Provider, ProviderContentPart, ProviderFilePart, ProviderImagePart, ProviderRegistry, ProviderTextPart, SessionToolBinding, SessionToolConfig, SideConfig, SubagentRelationship, SubagentToolConfig, SubpromptConfig, ThreadEventPayload, ThreadRegistryEntry, ThreadWatchdog, ThreadWatchdogState, ToolConfig, UpdateThreadParams, User, WatchdogCheckin, WatchdogProbeResult, applyRuntimeCors, buildImageDescription, canAccessThread, cat, createNamespaceContext, emitThreadEvent, enhanceFlowState, exists, find, forceTurn, generateImageDescription, getFileStats, getMessages, getMessagesToSummarize, getShortName, getThumbnail, getUnsummarizedImageAttachments, getVisibleAgentNames, getVisibleModelNames, getVisiblePromptNames, getVisibleToolNames, grep, hasImageAttachments, head, injectMessage, isAdminOnlyApiRoute, isHostedInstance, isPublicApiRoute, isQualifiedName, isSameOriginBrowserRequest, isTrustedLocalDevelopmentRequest, linkFile, mkdir, move, optimizeImageContext, parseQualifiedName, qualifyName, queueTool, readFile, readdir, reloadHistory, rename, replaceImagesWithDescriptions, resolveAgent, resolveHook, resolveModel, resolvePrompt, resolveTool, rmdir, runtimeCorsHeaders, runtimePreflightResponse, stat, tail, unlink, updateThread, writeFile, writeImage } from './runtime.js';
+import { M as ModelDefinition, A as AgentDefinition } from './resolver-BMZAzKD3.js';
+export { m as AgentBuilderEnv, n as AgentBuilderEvent, ah as BroadcastOptions, C as CodeExecutionBridge, h as DurableAgentBuilder, D as DurableThread, l as DurableUserHub, af as FlowStateSdk, ai as FlowStateWithSdk, G as HandlerSide, H as HubClientInfo, E as HumanSide, aq as ImageContextConfig, ae as InjectMessageOptions, as as LLMProviderInterface, aL as NamespaceResolutionError, w as PromptContent, s as PromptDefinition, y as PromptIncludePart, x as PromptPart, F as PromptSide, t as PromptToolConfig, P as Provider, at as ProviderContentPart, aw as ProviderFilePart, av as ProviderImagePart, ar as ProviderRegistry, au as ProviderTextPart, B as SessionToolBinding, z as SessionToolConfig, I as SideConfig, J as SubagentRelationship, u as SubagentToolConfig, S as SubpromptConfig, o as ThreadEventPayload, p as ThreadRegistryEntry, T as ThreadWatchdog, j as ThreadWatchdogState, v as ToolConfig, U as UpdateThreadParams, q as User, k as WatchdogCheckin, W as WatchdogProbeResult, f as applyRuntimeCors, am as buildImageDescription, c as canAccessThread, a9 as cat, aJ as createNamespaceContext, Q as emitThreadEvent, ag as enhanceFlowState, a0 as exists, ad as find, R as forceTurn, ap as generateImageDescription, a7 as getFileStats, N as getMessages, al as getMessagesToSummarize, az as getShortName, a8 as getThumbnail, ak as getUnsummarizedImageAttachments, aG as getVisibleAgentNames, aI as getVisibleModelNames, aH as getVisiblePromptNames, aF as getVisibleToolNames, ac as grep, aj as hasImageAttachments, aa as head, L as injectMessage, d as isAdminOnlyApiRoute, i as isHostedInstance, b as isPublicApiRoute, aK as isQualifiedName, e as isSameOriginBrowserRequest, a as isTrustedLocalDevelopmentRequest, Z as linkFile, a2 as mkdir, a5 as move, ao as optimizeImageContext, ax as parseQualifiedName, ay as qualifyName, K as queueTool, _ as readFile, a3 as readdir, O as reloadHistory, a6 as rename, an as replaceImagesWithDescriptions, aD as resolveAgent, aE as resolveHook, aC as resolveModel, aB as resolvePrompt, aA as resolveTool, a4 as rmdir, r as runtimeCorsHeaders, g as runtimePreflightResponse, $ as stat, ab as tail, a1 as unlink, V as updateThread, X as writeFile, Y as writeImage } from './resolver-BMZAzKD3.js';
 export { AgentPluginOptions, agentbuilder, builder } from './plugin.js';
-export { w as Agent, J as AttachmentRef, j as AuthContext, A as AuthUser, f as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, u as ClientDuplex, v as ClientForwarding, q as ClientStreamRequest, t as ClientStreamResponse, o as ClientToolRequest, p as ClientToolResponse, B as Controller, a as ControllerContext, G as Env, H as FileRecord, N as FileStats, D as FlowResult, F as FlowState, K as GrepResult, P as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, U as MessageContent, Q as MultimodalContent, R as RequestContext, S as StorageBackend, E as TelemetryEvent, O as TextContentPart, b as ThreadEndpointContext, e as ThreadEnv, x as ThreadInstance, y as ThreadMetadata, T as ToolCall, z as ToolResult, g as authenticate, k as callClient, l as callClientStream, c as createThreadEndpointHandler, n as decodeStreamChunk, d as defineController, m as encodeStreamChunk, i as endpointCallerFromAuth, h as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-PSu6cMEz.js';
+export { v as Agent, J as AttachmentRef, i as AuthContext, A as AuthUser, e as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, p as ClientStreamRequest, q as ClientStreamResponse, n as ClientToolRequest, o as ClientToolResponse, B as Controller, a as ControllerContext, G as Env, H as FileRecord, N as FileStats, D as FlowResult, F as FlowState, K as GrepResult, P as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, U as MessageContent, Q as MultimodalContent, R as RequestContext, S as StorageBackend, E as TelemetryEvent, O as TextContentPart, T as ThreadEndpointContext, b as ThreadEnv, w as ThreadInstance, x as ThreadMetadata, y as ToolCall, z as ToolResult, f as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as endpointCallerFromAuth, g as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-ChHAVogf.js';
 export { AgentType, DefineHandlerOptions, DefinitionLoader, GlobalNamespaceContext, HANDLER_SYMBOL, HandlerDefinition, HookExecutionContext, HookExecutionSource, HookSignatures, ImageContent, ModelCapabilities, ModelProvider, NamespaceContext, PackageSignature, PackedExports, PackedMeta, PackedMetadata, PackedNamespaceContext, ParentHookRequirement, ParentHookStage, PromptInput, PromptTextPart, ProviderAssistantMessage, ProviderConfigSlot, ProviderConfigSlots, ProviderConfigValueSource, ProviderDefinition, ProviderError, ProviderErrorCode, ProviderFactory, ProviderFactoryConfig, ProviderFinishReason, ProviderGeneratedImage, ProviderMessage, ProviderMessageContent, ProviderMethodOverrides, ModelCapabilities as ProviderModelCapabilities, ProviderOverride, ProviderOverrideContext, ProviderReasoningDetail, ProviderRequest, ProviderResponse, ProviderStreamChunk, ProviderSyncOverride, ProviderSystemMessage, ProviderTool, ProviderToolCallPart, ProviderToolMessage, ProviderToolResultContent, ProviderUsage, ProviderUserMessage, ReasoningConfig, StructuredPrompt, TextContent, ThreadHookName, Tool, ToolArgs, ToolArgsNode, ToolArgsRawShape, ToolContent, belongsToPackage, defineAgent, defineHandler, defineHook, defineModel, definePrompt, defineProvider, defineTool, isHandler, isPacked, isVisibleInNamespace, mapReasoningLevel, providerConst, providerEnv, providerValue } from '@standardagents/spec';
-export { C as ConstituentItem, D as DiscoveredPackage, N as NamespacedRegistry, P as PackingAnalysis, a as PackingOptions, b as PackingResult, c as UnpackOptions, d as UnpackResult } from './types-D1ABHvAH.js';
-export { D as DiscoveryConfig, P as PackageDiscoveryService, d as discoverPackages } from './discovery-CIGNVJfG.js';
+export { C as ConstituentItem, D as DiscoveredPackage, N as NamespacedRegistry, P as PackingAnalysis, a as PackingOptions, b as PackingResult, U as UnpackOptions, c as UnpackResult } from './types-Dhd0M369.js';
+export { D as DiscoveryConfig, P as PackageDiscoveryService, d as discoverPackages } from './discovery-D5pmuazY.js';
 import 'cloudflare:workers';
 import 'vite';
 import '@cloudflare/workers-types';

package/dist/index.js

@@ -37709,6 +37709,8 @@ import {
   applyRuntimeCors,
   runtimeCorsHeaders,
   runtimePreflightResponse,
+  formatUpstreamTiming,
+  withUpstreamTiming,
 } from "@standardagents/builder/runtime";
 import { isThreadEndpoint, getEndpointAccess } from "@standardagents/spec";
 
@@ -37833,13 +37835,19 @@ ${packedThreadRouteCode}
     // thread id, for same-request reuse by controllers (AB-05). Never cached
     // across requests.
     let threadAccess = null;
+    // The request handed to the controller. A protected API request carries
+    // x-standard-upstream-timing with the authentication cost; the header is
+    // overwritten, never merged, so a caller cannot forge upstream time.
+    let controllerRequest = request;
 
     // Require authentication for all API routes except public ones.
     // WebSocket tickets are single-use and are consumed here. Controllers
     // must reuse context.auth (resolveRequestAuth) rather than calling
     // requireAuth again, or a ticket-only upgrade will 401.
     if (isApiRoute && !publicRoute) {
+      const authStartedAt = Date.now();
       const authResult = await requireAuth(request, env);
+      controllerRequest = withUpstreamTiming(request, formatUpstreamTiming('auth', Date.now() - authStartedAt));
 
       // If requireAuth returns a Response, it's an error (401)
       if (authResult instanceof Response) {
@@ -37896,7 +37904,7 @@ ${packedThreadRouteCode}
     }
 
     const context = {
-      req: request,
+      req: controllerRequest,
       params: routeMatch.params || {},
       env: env,
       url: url,
@@ -39380,6 +39388,9 @@ var UserStateImpl = class {
   host;
   /** Caller descriptor for grant `allow` policy checks. */
   caller;
+  /** One identity lookup per execution: the singleton RPC runs at most once. */
+  identityLookup = null;
+  identityLookupMs = null;
   constructor(userId, host, caller) {
     this.userId = userId;
     this.host = host;
@@ -39391,6 +39402,22 @@ var UserStateImpl = class {
     return ns.get(ns.idFromName("singleton"));
   }
   async identity() {
+    if (!this.identityLookup) {
+      const started = Date.now();
+      this.identityLookup = this.lookupIdentity().finally(() => {
+        this.identityLookupMs = Date.now() - started;
+      });
+      this.identityLookup.catch(() => {
+        this.identityLookup = null;
+      });
+    }
+    return this.identityLookup;
+  }
+  /** Milliseconds the execution spent resolving identity, once it has. */
+  timing() {
+    return { identity_ms: this.identityLookupMs };
+  }
+  async lookupIdentity() {
     const user = await this.singleton().getUserById(this.userId);
     if (!user) throw new Error(`Unknown user: ${this.userId}`);
     return {
@@ -39489,6 +39516,44 @@ function createExecutionChain() {
   };
 }
 
+// src/users/upstream-timing.ts
+var UPSTREAM_TIMING_HEADER = "x-standard-upstream-timing";
+var MAX_HEADER_CHARS = 512;
+function formatUpstreamTiming(name, durationMs) {
+  const safe = Number.isFinite(durationMs) && durationMs > 0 ? durationMs : 0;
+  return `${name};dur=${Math.round(safe * 10) / 10}`;
+}
+function appendUpstreamTiming(current, name, durationMs) {
+  const entry = formatUpstreamTiming(name, durationMs);
+  if (!current) return entry;
+  const combined = `${current}, ${entry}`;
+  return combined.length > MAX_HEADER_CHARS ? current : combined;
+}
+function withUpstreamTiming(request, value) {
+  const headers = new Headers(request.headers);
+  headers.set(UPSTREAM_TIMING_HEADER, value);
+  return new Request(request, { headers });
+}
+function responseWithUpstreamTiming(response, name, durationMs) {
+  if (response.status === 101) return response;
+  const value = appendUpstreamTiming(response.headers.get(UPSTREAM_TIMING_HEADER), name, durationMs);
+  try {
+    response.headers.set(UPSTREAM_TIMING_HEADER, value);
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    headers.set(UPSTREAM_TIMING_HEADER, value);
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+}
+
+// src/durable-objects/DurableUserHub.ts
+init_bridge_owner();
+
 // src/users/grants.ts
 var INSTANCE_GRANTS_MAX_BYTES = 64 * 1024;
 var INSTANCE_GRANTS_MAX_COUNT = 64;
@@ -39729,11 +39794,7 @@ var DurableUserHub = class extends DurableObject {
     if (request.headers.get("Upgrade") === "websocket") {
       const pair = new WebSocketPair();
       const [client, server] = [pair[0], pair[1]];
-      const info = {
-        clientId: url.searchParams.get("client_id"),
-        clientName: url.searchParams.get("client_name"),
-        clientKind: url.searchParams.get("client_kind")
-      };
+      const info = parseBridgeClientParams(url).info;
       this.ensureHeartbeatAutoResponse();
       this.ctx.acceptWebSocket(server);
       server.serializeAttachment({ type: "hub_client", ...info });
@@ -39832,13 +39893,21 @@ var DurableUserHub = class extends DurableObject {
         { status: 500 }
       );
     }
+    const queuedAt = Date.now();
     return this.executionChain.run(async () => {
+      const queueMs = Date.now() - queuedAt;
+      const timed = withUpstreamTiming(
+        request,
+        appendUpstreamTiming(request.headers.get(UPSTREAM_TIMING_HEADER), "queue", queueMs)
+      );
       const user = new UserStateImpl(userId, this.scopeHost(), {
         kind: "userEndpoint",
         name: match.key
       });
       try {
-        return await handler.__handler(request, user, match.params);
+        const response = await handler.__handler(timed, user, match.params);
+        const identityMs = user.timing().identity_ms;
+        return identityMs === null ? response : responseWithUpstreamTiming(response, "identity", identityMs);
       } catch (error) {
         return Response.json(
           { error: error instanceof Error ? error.message : "User endpoint failed" },
@@ -39885,6 +39954,8 @@ var DurableUserHub = class extends DurableObject {
     this.ctx.waitUntil(run());
   }
   async webSocketClose(ws) {
+    this.clientSockets.delete(ws);
+    this.clientInfo.delete(ws);
     const attachment = ws.deserializeAttachment();
     if (attachment?.type === "user_stream") {
       this.dispatchUserHooks(String(attachment.userId), "user_client_detached", [
@@ -39893,10 +39964,7 @@ var DurableUserHub = class extends DurableObject {
           kind: typeof attachment.clientKind === "string" ? attachment.clientKind : void 0
         }
       ]);
-      return;
     }
-    this.clientSockets.delete(ws);
-    this.clientInfo.delete(ws);
   }
   // ─── User scope: credential grants (spec: Users §6) ───────────────────────
   /**
@@ -40017,7 +40085,16 @@ var DurableUserHub = class extends DurableObject {
     });
   }
   async webSocketMessage(ws, _message) {
-    if (!this.clientSockets.has(ws)) this.clientSockets.add(ws);
+    const attachment = ws.deserializeAttachment();
+    if (attachment?.type !== "hub_client") return;
+    if (!this.clientSockets.has(ws)) {
+      this.clientSockets.add(ws);
+      this.clientInfo.set(ws, {
+        clientId: typeof attachment.clientId === "string" ? attachment.clientId : null,
+        clientName: typeof attachment.clientName === "string" ? attachment.clientName : null,
+        clientKind: typeof attachment.clientKind === "string" ? attachment.clientKind : null
+      });
+    }
   }
   async webSocketError(ws) {
     await this.webSocketClose(ws);