@standardagents/builder 0.41.8 → 0.41.10

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { M as ModelDefinition, A as AgentDefinition } from './resolver-BMZAzKD3.js';
-export { m as AgentBuilderEnv, n as AgentBuilderEvent, ah as BroadcastOptions, C as CodeExecutionBridge, h as DurableAgentBuilder, D as DurableThread, l as DurableUserHub, af as FlowStateSdk, ai as FlowStateWithSdk, G as HandlerSide, H as HubClientInfo, E as HumanSide, aq as ImageContextConfig, ae as InjectMessageOptions, as as LLMProviderInterface, aL as NamespaceResolutionError, w as PromptContent, s as PromptDefinition, y as PromptIncludePart, x as PromptPart, F as PromptSide, t as PromptToolConfig, P as Provider, at as ProviderContentPart, aw as ProviderFilePart, av as ProviderImagePart, ar as ProviderRegistry, au as ProviderTextPart, B as SessionToolBinding, z as SessionToolConfig, I as SideConfig, J as SubagentRelationship, u as SubagentToolConfig, S as SubpromptConfig, o as ThreadEventPayload, p as ThreadRegistryEntry, T as ThreadWatchdog, j as ThreadWatchdogState, v as ToolConfig, U as UpdateThreadParams, q as User, k as WatchdogCheckin, W as WatchdogProbeResult, f as applyRuntimeCors, am as buildImageDescription, c as canAccessThread, a9 as cat, aJ as createNamespaceContext, Q as emitThreadEvent, ag as enhanceFlowState, a0 as exists, ad as find, R as forceTurn, ap as generateImageDescription, a7 as getFileStats, N as getMessages, al as getMessagesToSummarize, az as getShortName, a8 as getThumbnail, ak as getUnsummarizedImageAttachments, aG as getVisibleAgentNames, aI as getVisibleModelNames, aH as getVisiblePromptNames, aF as getVisibleToolNames, ac as grep, aj as hasImageAttachments, aa as head, L as injectMessage, d as isAdminOnlyApiRoute, i as isHostedInstance, b as isPublicApiRoute, aK as isQualifiedName, e as isSameOriginBrowserRequest, a as isTrustedLocalDevelopmentRequest, Z as linkFile, a2 as mkdir, a5 as move, ao as optimizeImageContext, ax as parseQualifiedName, ay as qualifyName, K as queueTool, _ as readFile, a3 as readdir, O as reloadHistory, a6 as rename, an as replaceImagesWithDescriptions, aD as resolveAgent, aE as resolveHook, aC as resolveModel, aB as resolvePrompt, aA as resolveTool, a4 as rmdir, r as runtimeCorsHeaders, g as runtimePreflightResponse, $ as stat, ab as tail, a1 as unlink, V as updateThread, X as writeFile, Y as writeImage } from './resolver-BMZAzKD3.js';
+import { M as ModelDefinition, A as AgentDefinition } from './resolver-kvVdxct2.js';
+export { m as AgentBuilderEnv, n as AgentBuilderEvent, ah as BroadcastOptions, C as CodeExecutionBridge, h as DurableAgentBuilder, D as DurableThread, l as DurableUserHub, af as FlowStateSdk, ai as FlowStateWithSdk, G as HandlerSide, H as HubClientInfo, E as HumanSide, aq as ImageContextConfig, ae as InjectMessageOptions, as as LLMProviderInterface, aL as NamespaceResolutionError, w as PromptContent, s as PromptDefinition, y as PromptIncludePart, x as PromptPart, F as PromptSide, t as PromptToolConfig, P as Provider, at as ProviderContentPart, aw as ProviderFilePart, av as ProviderImagePart, ar as ProviderRegistry, au as ProviderTextPart, B as SessionToolBinding, z as SessionToolConfig, I as SideConfig, J as SubagentRelationship, u as SubagentToolConfig, S as SubpromptConfig, o as ThreadEventPayload, p as ThreadRegistryEntry, T as ThreadWatchdog, j as ThreadWatchdogState, v as ToolConfig, U as UpdateThreadParams, q as User, k as WatchdogCheckin, W as WatchdogProbeResult, f as applyRuntimeCors, am as buildImageDescription, c as canAccessThread, a9 as cat, aJ as createNamespaceContext, Q as emitThreadEvent, ag as enhanceFlowState, a0 as exists, ad as find, R as forceTurn, ap as generateImageDescription, a7 as getFileStats, N as getMessages, al as getMessagesToSummarize, az as getShortName, a8 as getThumbnail, ak as getUnsummarizedImageAttachments, aG as getVisibleAgentNames, aI as getVisibleModelNames, aH as getVisiblePromptNames, aF as getVisibleToolNames, ac as grep, aj as hasImageAttachments, aa as head, L as injectMessage, d as isAdminOnlyApiRoute, i as isHostedInstance, b as isPublicApiRoute, aK as isQualifiedName, e as isSameOriginBrowserRequest, a as isTrustedLocalDevelopmentRequest, Z as linkFile, a2 as mkdir, a5 as move, ao as optimizeImageContext, ax as parseQualifiedName, ay as qualifyName, K as queueTool, _ as readFile, a3 as readdir, O as reloadHistory, a6 as rename, an as replaceImagesWithDescriptions, aD as resolveAgent, aE as resolveHook, aC as resolveModel, aB as resolvePrompt, aA as resolveTool, a4 as rmdir, r as runtimeCorsHeaders, g as runtimePreflightResponse, $ as stat, ab as tail, a1 as unlink, V as updateThread, X as writeFile, Y as writeImage } from './resolver-kvVdxct2.js';
 export { AgentPluginOptions, agentbuilder, builder } from './plugin.js';
 export { v as Agent, J as AttachmentRef, i as AuthContext, A as AuthUser, e as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, p as ClientStreamRequest, q as ClientStreamResponse, n as ClientToolRequest, o as ClientToolResponse, B as Controller, a as ControllerContext, G as Env, H as FileRecord, N as FileStats, D as FlowResult, F as FlowState, K as GrepResult, P as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, U as MessageContent, Q as MultimodalContent, R as RequestContext, S as StorageBackend, E as TelemetryEvent, O as TextContentPart, T as ThreadEndpointContext, b as ThreadEnv, w as ThreadInstance, x as ThreadMetadata, y as ToolCall, z as ToolResult, f as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as endpointCallerFromAuth, g as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-ChHAVogf.js';
 export { AgentType, DefineHandlerOptions, DefinitionLoader, GlobalNamespaceContext, HANDLER_SYMBOL, HandlerDefinition, HookExecutionContext, HookExecutionSource, HookSignatures, ImageContent, ModelCapabilities, ModelProvider, NamespaceContext, PackageSignature, PackedExports, PackedMeta, PackedMetadata, PackedNamespaceContext, ParentHookRequirement, ParentHookStage, PromptInput, PromptTextPart, ProviderAssistantMessage, ProviderConfigSlot, ProviderConfigSlots, ProviderConfigValueSource, ProviderDefinition, ProviderError, ProviderErrorCode, ProviderFactory, ProviderFactoryConfig, ProviderFinishReason, ProviderGeneratedImage, ProviderMessage, ProviderMessageContent, ProviderMethodOverrides, ModelCapabilities as ProviderModelCapabilities, ProviderOverride, ProviderOverrideContext, ProviderReasoningDetail, ProviderRequest, ProviderResponse, ProviderStreamChunk, ProviderSyncOverride, ProviderSystemMessage, ProviderTool, ProviderToolCallPart, ProviderToolMessage, ProviderToolResultContent, ProviderUsage, ProviderUserMessage, ReasoningConfig, StructuredPrompt, TextContent, ThreadHookName, Tool, ToolArgs, ToolArgsNode, ToolArgsRawShape, ToolContent, belongsToPackage, defineAgent, defineHandler, defineHook, defineModel, definePrompt, defineProvider, defineTool, isHandler, isPacked, isVisibleInNamespace, mapReasoningLevel, providerConst, providerEnv, providerValue } from '@standardagents/spec';

package/dist/index.js

@@ -1,6 +1,6 @@
 import { getProviderModelPricing } from '@standardagents/provider-pricing';
 import { jsonPathReader } from '@formkit/jsonreader';
-import { ProviderError, mapReasoningLevel, validateAgentDefinition, THREAD_STREAM_REASONING_PARAM, isUserEndpoint } from '@standardagents/spec';
+import { ProviderError, mapReasoningLevel, validateAgentDefinition, THREAD_STREAM_REASONING_PARAM, isUserRoom, isUserEndpoint } from '@standardagents/spec';
 export { HANDLER_SYMBOL, ProviderError, belongsToPackage, defineAgent, defineHandler, defineHook, defineModel, definePrompt, defineProvider, defineTool, isHandler, isPacked, isVisibleInNamespace, mapReasoningLevel, providerConst, providerEnv, providerValue } from '@standardagents/spec';
 import 'virtual:@standardagents-providers';
 import { DurableObject, WorkerEntrypoint } from 'cloudflare:workers';
@@ -39449,6 +39449,12 @@ var UserStateImpl = class {
   emit(event, data) {
     this.host.broadcastUserEvent(this.userId, event, data);
   }
+  async clients() {
+    return this.host.listRoomClients(this.userId);
+  }
+  async send(clientId, frame) {
+    return this.host.sendToRoomClient(this.userId, clientId, frame);
+  }
   async listThreads(options) {
     const { threads, total } = await this.singleton().listThreads({
       user_id: this.userId,
@@ -39554,6 +39560,69 @@ function responseWithUpstreamTiming(response, name, durationMs) {
 // src/durable-objects/DurableUserHub.ts
 init_bridge_owner();
 
+// src/users/room.ts
+var ROOM_FRAME_MAX_BYTES = 1024 * 1024;
+var ROOM_FRAME_RATE_PER_SECOND = 200;
+var ROOM_FRAME_BURST = 400;
+var ROOM_SEND_BUDGET_BYTES = 8 * 1024 * 1024;
+var ROOM_SEND_BUDGET_WINDOW_MS = 1e4;
+var ROOM_PRESENCE_GRACE_MS = 3e4;
+var ROOM_CLOSE_SUPERSEDED = 4001;
+var ROOM_CLOSE_TOO_LARGE = 1009;
+var ROOM_CLOSE_TRY_AGAIN = 1013;
+function parseRoomFrame(message) {
+  const size = typeof message === "string" ? message.length : message.byteLength;
+  if (size > ROOM_FRAME_MAX_BYTES) return "too_large";
+  if (typeof message !== "string") return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(message);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const frame = parsed;
+  if (frame.type !== "room" || typeof frame.id !== "string" || frame.id.length === 0 || frame.id.length > 256) {
+    return null;
+  }
+  return frame;
+}
+var RoomRateLimiter = class {
+  constructor(ratePerSecond = ROOM_FRAME_RATE_PER_SECOND, burst = ROOM_FRAME_BURST, now = Date.now()) {
+    this.ratePerSecond = ratePerSecond;
+    this.burst = burst;
+    this.tokens = burst;
+    this.last = now;
+  }
+  tokens;
+  last;
+  take(now = Date.now()) {
+    const elapsed = Math.max(0, now - this.last) / 1e3;
+    this.tokens = Math.min(this.burst, this.tokens + elapsed * this.ratePerSecond);
+    this.last = now;
+    if (this.tokens < 1) return false;
+    this.tokens -= 1;
+    return true;
+  }
+};
+var RoomSendBudget = class {
+  constructor(budgetBytes = ROOM_SEND_BUDGET_BYTES, windowMs = ROOM_SEND_BUDGET_WINDOW_MS, now = Date.now()) {
+    this.budgetBytes = budgetBytes;
+    this.windowMs = windowMs;
+    this.windowStart = now;
+  }
+  spent = 0;
+  windowStart;
+  charge(bytes, now = Date.now()) {
+    if (now - this.windowStart >= this.windowMs) {
+      this.windowStart = now;
+      this.spent = 0;
+    }
+    this.spent += bytes;
+    return this.spent <= this.budgetBytes;
+  }
+};
+
 // src/users/grants.ts
 var INSTANCE_GRANTS_MAX_BYTES = 64 * 1024;
 var INSTANCE_GRANTS_MAX_COUNT = 64;
@@ -39676,6 +39745,9 @@ function callerAllowed(allow, caller) {
     endpoint: allow.endpoints,
     userEndpoint: allow.userEndpoints,
     userHook: allow.userEndpoints,
+    // A room execution is policy-named by its registry key; a policy may
+    // list it under `userRooms` or alongside the endpoints it serves.
+    userRoom: allow.userRooms ?? allow.userEndpoints,
     agent: allow.agents
   };
   const list = lists[caller.kind];
@@ -39709,6 +39781,14 @@ var DurableUserHub = class extends DurableObject {
   clientSockets = /* @__PURE__ */ new Set();
   clientInfo = /* @__PURE__ */ new Map();
   migrated = false;
+  /** Inbound frame rate and outbound byte budget per room socket. */
+  roomLimits = /* @__PURE__ */ new Map();
+  /** Detach notices held for the presence grace window, by client id. */
+  pendingDetach = /* @__PURE__ */ new Map();
+  /** The project's room definition, loaded once per instance, and its
+   *  registry key, which names room executions for grant policies. */
+  roomDefinition = null;
+  roomKey = null;
   constructor(ctx, env) {
     super(ctx, env);
     ctx.blockConcurrencyWhile(async () => {
@@ -39721,7 +39801,8 @@ var DurableUserHub = class extends DurableObject {
         this.clientInfo.set(ws, {
           clientId: typeof attachment.clientId === "string" ? attachment.clientId : null,
           clientName: typeof attachment.clientName === "string" ? attachment.clientName : null,
-          clientKind: typeof attachment.clientKind === "string" ? attachment.clientKind : null
+          clientKind: typeof attachment.clientKind === "string" ? attachment.clientKind : null,
+          since: typeof attachment.since === "number" ? attachment.since : void 0
         });
       }
     }
@@ -39794,20 +39875,191 @@ var DurableUserHub = class extends DurableObject {
     if (request.headers.get("Upgrade") === "websocket") {
       const pair = new WebSocketPair();
       const [client, server] = [pair[0], pair[1]];
-      const info = parseBridgeClientParams(url).info;
+      const info = { ...parseBridgeClientParams(url).info, since: Date.now() };
       this.ensureHeartbeatAutoResponse();
       this.ctx.acceptWebSocket(server);
       server.serializeAttachment({ type: "hub_client", ...info });
+      const reconnecting = info.clientId !== null && this.supersedeClient(info.clientId, server);
       this.clientSockets.add(server);
       this.clientInfo.set(server, info);
       try {
         server.send(JSON.stringify({ type: "hub_ready" }));
       } catch {
       }
+      if (info.clientId) {
+        const connection = this.connectionOf(info);
+        if (connection) this.observeAttach(connection, reconnecting);
+      }
       return new Response(null, { status: 101, webSocket: client });
     }
     return new Response("Not found", { status: 404 });
   }
+  // ─── Room connections (spec: Users rooms) ───────────────────────────────────
+  connectionOf(info) {
+    if (!info?.clientId) return null;
+    return { clientId: info.clientId, clientKind: info.clientKind, since: info.since ?? 0 };
+  }
+  /** Close every other socket presenting `clientId`; true when one existed. */
+  supersedeClient(clientId, keep) {
+    let superseded = false;
+    for (const ws of Array.from(this.clientSockets)) {
+      if (ws === keep || this.clientInfo.get(ws)?.clientId !== clientId) continue;
+      this.forgetSocket(ws);
+      superseded = true;
+      try {
+        ws.send(JSON.stringify({ type: "superseded" }));
+      } catch {
+      }
+      try {
+        ws.close(ROOM_CLOSE_SUPERSEDED, "Superseded by a newer connection from this client");
+      } catch {
+      }
+    }
+    return superseded;
+  }
+  forgetSocket(ws) {
+    this.clientSockets.delete(ws);
+    this.clientInfo.delete(ws);
+    this.roomLimits.delete(ws);
+  }
+  liveSocketFor(clientId) {
+    for (const ws of this.clientSockets) {
+      if (this.clientInfo.get(ws)?.clientId === clientId && ws.readyState === WebSocket.OPEN) return ws;
+    }
+    return null;
+  }
+  /** Live room connections, one per client id, oldest attachment first. */
+  listRoomClients() {
+    const byId = /* @__PURE__ */ new Map();
+    for (const ws of this.clientSockets) {
+      if (ws.readyState !== WebSocket.OPEN) continue;
+      const connection = this.connectionOf(this.clientInfo.get(ws));
+      if (connection) byId.set(connection.clientId, connection);
+    }
+    return Array.from(byId.values()).sort((a, b) => a.since - b.since);
+  }
+  /** Deliver one frame to the socket carrying `clientId`, within its send budget. */
+  sendToRoomClient(clientId, frame) {
+    const ws = this.liveSocketFor(clientId);
+    if (!ws) return false;
+    return this.sendRoomFrame(ws, JSON.stringify(frame));
+  }
+  sendRoomFrame(ws, payload) {
+    const limits = this.limitsFor(ws);
+    if (!limits.send.charge(payload.length)) {
+      this.forgetSocket(ws);
+      try {
+        ws.close(ROOM_CLOSE_TRY_AGAIN, "Slow consumer: send budget exceeded");
+      } catch {
+      }
+      return false;
+    }
+    try {
+      ws.send(payload);
+      return true;
+    } catch {
+      this.forgetSocket(ws);
+      return false;
+    }
+  }
+  limitsFor(ws) {
+    let limits = this.roomLimits.get(ws);
+    if (!limits) {
+      limits = { rate: new RoomRateLimiter(), send: new RoomSendBudget() };
+      this.roomLimits.set(ws, limits);
+    }
+    return limits;
+  }
+  /** Load the project's room definition from the users registry, once. */
+  async loadRoom() {
+    if (!this.roomDefinition) {
+      this.roomDefinition = (async () => {
+        const registry = this.userEndpoints();
+        for (const key of Object.keys(registry)) {
+          if (!/(^|\/)room$/.test(key)) continue;
+          try {
+            const loaded = await registry[key]();
+            const candidate = loaded.default ?? loaded;
+            if (isUserRoom(candidate)) {
+              this.roomKey = key;
+              return candidate;
+            }
+          } catch {
+          }
+        }
+        return null;
+      })();
+    }
+    return this.roomDefinition;
+  }
+  /** Whether `key` is room-owned state, exempt from `user_value_changed`. */
+  async roomOwnsKey(key) {
+    const room = await this.loadRoom();
+    return Boolean(room?.valuePrefix && key.startsWith(room.valuePrefix));
+  }
+  /**
+   * Presence runs inside the serialization chain, after any execution the
+   * event raced with, so a room's presence write never interleaves with a
+   * mutation. A reconnect inside the grace window is not a change.
+   */
+  observeAttach(connection, reconnecting) {
+    const pending = this.pendingDetach.get(connection.clientId);
+    if (pending) {
+      clearTimeout(pending);
+      this.pendingDetach.delete(connection.clientId);
+      return;
+    }
+    if (reconnecting) return;
+    this.dispatchRoomPresence({ kind: "attached", connection, at: Date.now() });
+  }
+  observeDetach(connection) {
+    if (this.liveSocketFor(connection.clientId)) return;
+    const existing = this.pendingDetach.get(connection.clientId);
+    if (existing) clearTimeout(existing);
+    this.pendingDetach.set(
+      connection.clientId,
+      setTimeout(() => {
+        this.pendingDetach.delete(connection.clientId);
+        if (this.liveSocketFor(connection.clientId)) return;
+        this.dispatchRoomPresence({ kind: "detached", connection, at: Date.now() });
+      }, ROOM_PRESENCE_GRACE_MS)
+    );
+  }
+  dispatchRoomPresence(event) {
+    const run = this.executionChain.run(async () => {
+      const room = await this.loadRoom();
+      if (!room?.onPresence) return;
+      const user = new UserStateImpl(this.roomUserId(), this.scopeHost(), { kind: "userRoom", name: this.roomKey ?? "room" });
+      try {
+        await room.onPresence(user, event);
+      } catch (error) {
+        console.error("[DurableUserHub] room presence handler failed:", error);
+      }
+    });
+    this.ctx.waitUntil(run);
+  }
+  /** The hub is one object per user; its name is the user id. */
+  roomUserId() {
+    return this.ctx.id.name ?? this.ctx.id.toString();
+  }
+  async dispatchRoomFrame(ws, frame) {
+    const connection = this.connectionOf(this.clientInfo.get(ws));
+    if (!connection) return;
+    await this.executionChain.run(async () => {
+      const room = await this.loadRoom();
+      if (!room) {
+        this.sendRoomFrame(ws, JSON.stringify({ type: "room", id: frame.id, error: "no_room" }));
+        return;
+      }
+      const user = new UserStateImpl(this.roomUserId(), this.scopeHost(), { kind: "userRoom", name: this.roomKey ?? "room" });
+      try {
+        await room.onFrame(user, connection, frame);
+      } catch (error) {
+        console.error("[DurableUserHub] room frame handler failed:", error);
+        this.sendRoomFrame(ws, JSON.stringify({ type: "room", id: frame.id, error: "handler_failed" }));
+      }
+    });
+  }
   // ─── User scope: event stream (spec: Users §4) ─────────────────────────────
   /** Idle sockets answer heartbeats at the edge without waking the object.
    *  Registered at accept time rather than in the constructor so a hub that
@@ -39845,8 +40097,9 @@ var DurableUserHub = class extends DurableObject {
     return new Response(null, { status: 101, webSocket: client });
   }
   /**
-   * Deliver an event frame to every socket attached to this user's stream.
-   * At-most-once, live-only (spec: Users §4) — no history, no acks.
+   * Deliver an event frame to every socket attached to this user's stream
+   * and to every room socket. At-most-once, live-only (spec: Users §4) —
+   * no history, no acks.
    */
   broadcastUserEvent(userId, event, data) {
     const frame = JSON.stringify({ event, data });
@@ -39858,6 +40111,10 @@ var DurableUserHub = class extends DurableObject {
       } catch {
       }
     }
+    for (const ws of Array.from(this.clientSockets)) {
+      if (ws.readyState !== WebSocket.OPEN || !this.clientInfo.get(ws)?.clientId) continue;
+      this.sendRoomFrame(ws, frame);
+    }
   }
   // ─── User scope: serialized endpoint execution (spec: Users §2.1, §3) ─────
   /** Per-user execution chain (spec: Users §2.1) — see users/serialize.ts. */
@@ -39868,6 +40125,8 @@ var DurableUserHub = class extends DurableObject {
       setUserValue: (userId, key, value) => this.setUserValue(userId, key, value),
       listUserValues: (userId, options) => this.listUserValues(userId, options ?? {}),
       broadcastUserEvent: (userId, event, data) => this.broadcastUserEvent(userId, event, data),
+      listRoomClients: () => this.listRoomClients(),
+      sendToRoomClient: (_userId, clientId, frame) => this.sendToRoomClient(clientId, frame),
       grantFetch: (userId, grant, req) => this.grantFetch(userId, grant, req),
       env: this.env
     };
@@ -39887,6 +40146,7 @@ var DurableUserHub = class extends DurableObject {
     }
     const module = loaded;
     const handler = module.default ?? loaded;
+    if (isUserRoom(handler)) return Response.json({ error: "Not found" }, { status: 404 });
     if (!isUserEndpoint(handler)) {
       return Response.json(
         { error: `${match.key} is not a defineUserEndpoint export` },
@@ -39930,6 +40190,7 @@ var DurableUserHub = class extends DurableObject {
     const names = Object.keys(registry);
     if (names.length === 0) return;
     const run = async () => {
+      if (hookType === "user_value_changed" && await this.roomOwnsKey(String(args[0]))) return;
       const user = new UserStateImpl(userId, this.scopeHost(), {
         kind: "userHook",
         name: hookType
@@ -39954,8 +40215,9 @@ var DurableUserHub = class extends DurableObject {
     this.ctx.waitUntil(run());
   }
   async webSocketClose(ws) {
-    this.clientSockets.delete(ws);
-    this.clientInfo.delete(ws);
+    const connection = this.connectionOf(this.clientInfo.get(ws));
+    this.forgetSocket(ws);
+    if (connection) this.observeDetach(connection);
     const attachment = ws.deserializeAttachment();
     if (attachment?.type === "user_stream") {
       this.dispatchUserHooks(String(attachment.userId), "user_client_detached", [
@@ -40084,7 +40346,7 @@ var DurableUserHub = class extends DurableObject {
       caller: body.caller ?? { kind: "unknown", name: "unknown" }
     });
   }
-  async webSocketMessage(ws, _message) {
+  async webSocketMessage(ws, message) {
     const attachment = ws.deserializeAttachment();
     if (attachment?.type !== "hub_client") return;
     if (!this.clientSockets.has(ws)) {
@@ -40092,9 +40354,29 @@ var DurableUserHub = class extends DurableObject {
       this.clientInfo.set(ws, {
         clientId: typeof attachment.clientId === "string" ? attachment.clientId : null,
         clientName: typeof attachment.clientName === "string" ? attachment.clientName : null,
-        clientKind: typeof attachment.clientKind === "string" ? attachment.clientKind : null
+        clientKind: typeof attachment.clientKind === "string" ? attachment.clientKind : null,
+        since: typeof attachment.since === "number" ? attachment.since : void 0
       });
     }
+    if (!this.limitsFor(ws).rate.take()) {
+      this.forgetSocket(ws);
+      try {
+        ws.close(ROOM_CLOSE_TRY_AGAIN, "Frame rate exceeded");
+      } catch {
+      }
+      return;
+    }
+    const frame = parseRoomFrame(message);
+    if (frame === "too_large") {
+      this.forgetSocket(ws);
+      try {
+        ws.close(ROOM_CLOSE_TOO_LARGE, "Frame exceeds 1 MiB");
+      } catch {
+      }
+      return;
+    }
+    if (frame === null || !this.clientInfo.get(ws)?.clientId) return;
+    await this.dispatchRoomFrame(ws, frame);
   }
   async webSocketError(ws) {
     await this.webSocketClose(ws);