@standardagents/builder 0.41.15 → 0.41.17

package/dist/{index-ChHAVogf.d.ts → index-C82dLGPq.d.ts}

@@ -1190,6 +1190,8 @@ interface AuthUser {
      * no explicit set — see {@link hasPermission} for the fallback rules.
      */
     permissions?: string[] | null;
+    /** Application roles, independent of built-in instance permissions. */
+    roles?: string[];
     platform_user_id?: string | null;
     email?: string | null;
     display_name?: string | null;
@@ -1609,6 +1611,7 @@ interface AuthenticationUser {
     password_hash: string;
     role: 'admin' | 'user' | 'api';
     permissions?: string | null;
+    roles?: string[];
     platform_user_id?: string | null;
     email?: string | null;
     display_name?: string | null;
@@ -1864,6 +1867,17 @@ interface DurableAgentBuilderRpc {
         user_id: string;
         id: string;
     } | null>;
+    createApiKey(params: {
+        name: string;
+        key_hash: string;
+        key_prefix: string;
+        last_five: string;
+        user_id: string;
+    }): Promise<string>;
+    getUserByPlatformUserId(platformUserId: string): Promise<{
+        id: string;
+        username: string;
+    } | null>;
     consumeAuthRateLimit(params: {
         key: string;
         limit: number;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { M as ModelDefinition, A as AgentDefinition } from './resolver-DE5HFRlb.js';
-export { m as AgentBuilderEnv, n as AgentBuilderEvent, ah as BroadcastOptions, C as CodeExecutionBridge, h as DurableAgentBuilder, D as DurableThread, l as DurableUserHub, af as FlowStateSdk, ai as FlowStateWithSdk, G as HandlerSide, H as HubClientInfo, E as HumanSide, aq as ImageContextConfig, ae as InjectMessageOptions, as as LLMProviderInterface, aL as NamespaceResolutionError, w as PromptContent, s as PromptDefinition, y as PromptIncludePart, x as PromptPart, F as PromptSide, t as PromptToolConfig, P as Provider, at as ProviderContentPart, aw as ProviderFilePart, av as ProviderImagePart, ar as ProviderRegistry, au as ProviderTextPart, B as SessionToolBinding, z as SessionToolConfig, I as SideConfig, J as SubagentRelationship, u as SubagentToolConfig, S as SubpromptConfig, o as ThreadEventPayload, p as ThreadRegistryEntry, T as ThreadWatchdog, j as ThreadWatchdogState, v as ToolConfig, U as UpdateThreadParams, q as User, k as WatchdogCheckin, W as WatchdogProbeResult, f as applyRuntimeCors, am as buildImageDescription, c as canAccessThread, a9 as cat, aJ as createNamespaceContext, Q as emitThreadEvent, ag as enhanceFlowState, a0 as exists, ad as find, R as forceTurn, ap as generateImageDescription, a7 as getFileStats, N as getMessages, al as getMessagesToSummarize, az as getShortName, a8 as getThumbnail, ak as getUnsummarizedImageAttachments, aG as getVisibleAgentNames, aI as getVisibleModelNames, aH as getVisiblePromptNames, aF as getVisibleToolNames, ac as grep, aj as hasImageAttachments, aa as head, L as injectMessage, d as isAdminOnlyApiRoute, i as isHostedInstance, b as isPublicApiRoute, aK as isQualifiedName, e as isSameOriginBrowserRequest, a as isTrustedLocalDevelopmentRequest, Z as linkFile, a2 as mkdir, a5 as move, ao as optimizeImageContext, ax as parseQualifiedName, ay as qualifyName, K as queueTool, _ as readFile, a3 as readdir, O as reloadHistory, a6 as rename, an as replaceImagesWithDescriptions, aD as resolveAgent, aE as resolveHook, aC as resolveModel, aB as resolvePrompt, aA as resolveTool, a4 as rmdir, r as runtimeCorsHeaders, g as runtimePreflightResponse, $ as stat, ab as tail, a1 as unlink, V as updateThread, X as writeFile, Y as writeImage } from './resolver-DE5HFRlb.js';
+import { M as ModelDefinition, A as AgentDefinition } from './resolver-eygn_O1w.js';
+export { m as AgentBuilderEnv, n as AgentBuilderEvent, ah as BroadcastOptions, C as CodeExecutionBridge, h as DurableAgentBuilder, D as DurableThread, l as DurableUserHub, af as FlowStateSdk, ai as FlowStateWithSdk, G as HandlerSide, H as HubClientInfo, E as HumanSide, aq as ImageContextConfig, ae as InjectMessageOptions, as as LLMProviderInterface, aL as NamespaceResolutionError, w as PromptContent, s as PromptDefinition, y as PromptIncludePart, x as PromptPart, F as PromptSide, t as PromptToolConfig, P as Provider, at as ProviderContentPart, aw as ProviderFilePart, av as ProviderImagePart, ar as ProviderRegistry, au as ProviderTextPart, B as SessionToolBinding, z as SessionToolConfig, I as SideConfig, J as SubagentRelationship, u as SubagentToolConfig, S as SubpromptConfig, o as ThreadEventPayload, p as ThreadRegistryEntry, T as ThreadWatchdog, j as ThreadWatchdogState, v as ToolConfig, U as UpdateThreadParams, q as User, k as WatchdogCheckin, W as WatchdogProbeResult, f as applyRuntimeCors, am as buildImageDescription, c as canAccessThread, a9 as cat, aJ as createNamespaceContext, Q as emitThreadEvent, ag as enhanceFlowState, a0 as exists, ad as find, R as forceTurn, ap as generateImageDescription, a7 as getFileStats, N as getMessages, al as getMessagesToSummarize, az as getShortName, a8 as getThumbnail, ak as getUnsummarizedImageAttachments, aG as getVisibleAgentNames, aI as getVisibleModelNames, aH as getVisiblePromptNames, aF as getVisibleToolNames, ac as grep, aj as hasImageAttachments, aa as head, L as injectMessage, d as isAdminOnlyApiRoute, i as isHostedInstance, b as isPublicApiRoute, aK as isQualifiedName, e as isSameOriginBrowserRequest, a as isTrustedLocalDevelopmentRequest, Z as linkFile, a2 as mkdir, a5 as move, ao as optimizeImageContext, ax as parseQualifiedName, ay as qualifyName, K as queueTool, _ as readFile, a3 as readdir, O as reloadHistory, a6 as rename, an as replaceImagesWithDescriptions, aD as resolveAgent, aE as resolveHook, aC as resolveModel, aB as resolvePrompt, aA as resolveTool, a4 as rmdir, r as runtimeCorsHeaders, g as runtimePreflightResponse, $ as stat, ab as tail, a1 as unlink, V as updateThread, X as writeFile, Y as writeImage } from './resolver-eygn_O1w.js';
 export { AgentPluginOptions, agentbuilder, builder } from './plugin.js';
-export { v as Agent, J as AttachmentRef, i as AuthContext, A as AuthUser, e as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, p as ClientStreamRequest, q as ClientStreamResponse, n as ClientToolRequest, o as ClientToolResponse, B as Controller, a as ControllerContext, G as Env, H as FileRecord, N as FileStats, D as FlowResult, F as FlowState, K as GrepResult, P as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, U as MessageContent, Q as MultimodalContent, R as RequestContext, S as StorageBackend, E as TelemetryEvent, O as TextContentPart, T as ThreadEndpointContext, b as ThreadEnv, w as ThreadInstance, x as ThreadMetadata, y as ToolCall, z as ToolResult, f as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as endpointCallerFromAuth, g as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-ChHAVogf.js';
+export { v as Agent, J as AttachmentRef, i as AuthContext, A as AuthUser, e as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, p as ClientStreamRequest, q as ClientStreamResponse, n as ClientToolRequest, o as ClientToolResponse, B as Controller, a as ControllerContext, G as Env, H as FileRecord, N as FileStats, D as FlowResult, F as FlowState, K as GrepResult, P as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, U as MessageContent, Q as MultimodalContent, R as RequestContext, S as StorageBackend, E as TelemetryEvent, O as TextContentPart, T as ThreadEndpointContext, b as ThreadEnv, w as ThreadInstance, x as ThreadMetadata, y as ToolCall, z as ToolResult, f as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as endpointCallerFromAuth, g as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-C82dLGPq.js';
 export { AgentType, DefineHandlerOptions, DefinitionLoader, GlobalNamespaceContext, HANDLER_SYMBOL, HandlerDefinition, HookExecutionContext, HookExecutionSource, HookSignatures, ImageContent, ModelCapabilities, ModelProvider, NamespaceContext, PackageSignature, PackedExports, PackedMeta, PackedMetadata, PackedNamespaceContext, ParentHookRequirement, ParentHookStage, PromptInput, PromptTextPart, ProviderAssistantMessage, ProviderConfigSlot, ProviderConfigSlots, ProviderConfigValueSource, ProviderDefinition, ProviderError, ProviderErrorCode, ProviderFactory, ProviderFactoryConfig, ProviderFinishReason, ProviderGeneratedImage, ProviderMessage, ProviderMessageContent, ProviderMethodOverrides, ModelCapabilities as ProviderModelCapabilities, ProviderOverride, ProviderOverrideContext, ProviderReasoningDetail, ProviderRequest, ProviderResponse, ProviderStreamChunk, ProviderSyncOverride, ProviderSystemMessage, ProviderTool, ProviderToolCallPart, ProviderToolMessage, ProviderToolResultContent, ProviderUsage, ProviderUserMessage, ReasoningConfig, StructuredPrompt, TextContent, ThreadHookName, Tool, ToolArgs, ToolArgsNode, ToolArgsRawShape, ToolContent, belongsToPackage, defineAgent, defineHandler, defineHook, defineModel, definePrompt, defineProvider, defineTool, isHandler, isPacked, isVisibleInNamespace, mapReasoningLevel, providerConst, providerEnv, providerValue } from '@standardagents/spec';
 export { C as ConstituentItem, D as DiscoveredPackage, N as NamespacedRegistry, P as PackingAnalysis, a as PackingOptions, b as PackingResult, U as UnpackOptions, c as UnpackResult } from './types-Dhd0M369.js';
 export { D as DiscoveryConfig, P as PackageDiscoveryService, d as discoverPackages } from './discovery-D5pmuazY.js';

package/dist/index.js

@@ -10329,6 +10329,24 @@ var init_platform_handoff_jtis = __esm({
   }
 });
 
+// src/durable-objects/agentbuilder-migrations/0022_application_roles.ts
+var migration60;
+var init_application_roles = __esm({
+  "src/durable-objects/agentbuilder-migrations/0022_application_roles.ts"() {
+    migration60 = {
+      version: 22,
+      async up(sql) {
+        sql.exec(`CREATE TABLE platform_application_roles (
+      platform_user_id TEXT PRIMARY KEY,
+      roles TEXT NOT NULL DEFAULT '[]',
+      roles_version INTEGER NOT NULL DEFAULT 0
+    )`);
+        sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '22')`);
+      }
+    };
+  }
+});
+
 // src/durable-objects/agentbuilder-migrations/index.ts
 var migrations2, LATEST_SCHEMA_VERSION2;
 var init_agentbuilder_migrations = __esm({
@@ -10354,9 +10372,10 @@ var init_agentbuilder_migrations = __esm({
     init_scope_skills();
     init_websocket_tickets();
     init_platform_handoff_jtis();
-    migrations2 = [migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52, migration53, migration54, migration55, migration56, migration57, migration58, migration59];
+    init_application_roles();
+    migrations2 = [migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52, migration53, migration54, migration55, migration56, migration57, migration58, migration59, migration60];
     LATEST_SCHEMA_VERSION2 = migrations2.reduce(
-      (max, migration60) => Math.max(max, migration60.version),
+      (max, migration61) => Math.max(max, migration61.version),
       0
     );
   }
@@ -11165,9 +11184,9 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         }
       }
       async runMigrations(fromVersion) {
-        for (const migration60 of migrations2) {
-          if (migration60.version > fromVersion) {
-            await migration60.up(this.ctx.storage.sql);
+        for (const migration61 of migrations2) {
+          if (migration61.version > fromVersion) {
+            await migration61.up(this.ctx.storage.sql);
           }
         }
       }
@@ -12722,6 +12741,7 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           // admin meaning.
           role: row.role === "user" ? "user" : row.role === "api" ? "api" : "admin",
           permissions: parseStoredPermissions(row.permissions),
+          roles: parseStoredPermissions(row.roles) ?? [],
           platform_user_id: row.platform_user_id ?? null,
           email: row.email ?? null,
           display_name: row.display_name ?? null,
@@ -12739,7 +12759,8 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         await this.ensureMigrated();
         const cursor = await this.ctx.storage.sql.exec(
           `SELECT id, username, password_hash, COALESCE(instance_role, role) AS role,
-        permissions, platform_user_id, email, display_name, avatar_url, source, replica_active,
+        permissions, (SELECT roles FROM platform_application_roles WHERE platform_user_id = users.platform_user_id) AS roles,
+        platform_user_id, email, display_name, avatar_url, source, replica_active,
         created_at, updated_at
        FROM users WHERE username = ? AND deleted_at IS NULL AND replica_active != 0`,
           username
@@ -12755,7 +12776,8 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         await this.ensureMigrated();
         const cursor = await this.ctx.storage.sql.exec(
           `SELECT id, username, password_hash, COALESCE(instance_role, role) AS role,
-        permissions, platform_user_id, email, display_name, avatar_url, source, replica_active,
+        permissions, (SELECT roles FROM platform_application_roles WHERE platform_user_id = users.platform_user_id) AS roles,
+        platform_user_id, email, display_name, avatar_url, source, replica_active,
         created_at, updated_at
        FROM users WHERE id = ? AND deleted_at IS NULL AND replica_active != 0`,
           id
@@ -12799,6 +12821,7 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           password_hash: params.password_hash,
           role: params.role || "admin",
           permissions: params.permissions ?? null,
+          roles: [],
           platform_user_id: params.platform_user_id ?? null,
           email: params.email ?? null,
           display_name: params.display_name ?? null,
@@ -12932,11 +12955,31 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         );
         return true;
       }
-      /**
-       * Upsert a platform-replicated identity and return the local user row.
-       */
+      /** Apply an authoritative role replacement while retaining revocation fences. */
+      applyApplicationRoles(platformUserId, roles, version, revoke = false) {
+        const revision = version === void 0 ? 0 : version;
+        if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 0) {
+          throw new Error("Invalid application roles revision");
+        }
+        if (roles !== void 0 && (!Array.isArray(roles) || !roles.every((role) => typeof role === "string"))) {
+          throw new Error("Invalid application roles");
+        }
+        this.ctx.storage.sql.exec(
+          `INSERT INTO platform_application_roles (platform_user_id, roles, roles_version)
+       VALUES (?, ?, ?)
+       ON CONFLICT(platform_user_id) DO UPDATE SET roles = excluded.roles, roles_version = excluded.roles_version
+       WHERE excluded.roles_version > platform_application_roles.roles_version
+          OR (? = 1 AND excluded.roles_version = platform_application_roles.roles_version)`,
+          platformUserId,
+          JSON.stringify(roles ?? []),
+          revision,
+          revoke ? 1 : 0
+        );
+      }
+      /** Upsert a platform-replicated identity and return the local user row. */
       async upsertPlatformReplicaUser(replica) {
         await this.ensureMigrated();
+        this.applyApplicationRoles(replica.platform_user_id, replica.roles, replica.roles_version);
         const now = Math.floor(Date.now() / 1e3);
         const fallback = this.normalizeReplicaUsername(
           replica.email?.split("@")[0] ?? null,
@@ -12983,7 +13026,7 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           }
           return updated;
         }
-        return this.createUser({
+        const created = await this.createUser({
           username: availableUsername,
           password_hash: `platform-replica:${crypto.randomUUID()}`,
           role: replica.role,
@@ -12994,12 +13037,18 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           avatar_url: replica.avatar_url ?? null,
           source: "standard_agents"
         });
+        const user = await this.getUserById(created.id);
+        if (!user) throw new Error("Failed to load replicated user after creation");
+        return user;
       }
       /**
        * Apply a full platform read-replica snapshot for this instance.
        */
       async applyPlatformReplicaSnapshot(snapshot) {
         await this.ensureMigrated();
+        for (const revocation of snapshot.role_revocations ?? []) {
+          this.applyApplicationRoles(revocation.platform_user_id, [], revocation.roles_version, true);
+        }
         const activeUserIds = /* @__PURE__ */ new Set();
         for (const replicaUser of snapshot.users) {
           const user = await this.upsertPlatformReplicaUser(replicaUser);
@@ -13052,10 +13101,9 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         const keys = snapshot.api_keys ?? [];
         for (const key of keys) {
           const user = key.user_platform_id ? await this.getUserByPlatformUserId(key.user_platform_id) : await this.getFirstReplicaAdminUser();
-          const keyUser = user ?? await this.getFirstReplicaAdminUser();
-          if (!keyUser) continue;
+          if (!user) continue;
           activePlatformKeyIds.add(key.id);
-          await this.upsertPlatformReplicaApiKey(key, keyUser.id);
+          await this.upsertPlatformReplicaApiKey(key, user.id);
         }
         const now = Math.floor(Date.now() / 1e3);
         if (activePlatformKeyIds.size > 0) {
@@ -17667,9 +17715,9 @@ var init_DurableThread = __esm({
        * Each migration is run in order, starting from the current version + 1.
        */
       async runMigrations(fromVersion) {
-        for (const migration60 of migrations) {
-          if (migration60.version > fromVersion) {
-            await migration60.up(this.ctx.storage.sql);
+        for (const migration61 of migrations) {
+          if (migration61.version > fromVersion) {
+            await migration61.up(this.ctx.storage.sql);
           }
         }
       }
@@ -29547,6 +29595,7 @@ var init_ThreadStateImpl = __esm({
           username: user.username,
           role: user.role,
           permissions: user.permissions ?? null,
+          roles: user.roles ?? [],
           email: user.email ?? null,
           display_name: user.display_name ?? null,
           avatar_url: user.avatar_url ?? null
@@ -30241,14 +30290,7 @@ declare module 'virtual:@standardagents/builder' {
     terminated?: number | null;
   }
 
-  export interface User {
-    id: string;
-    username: string;
-    password_hash: string;
-    role: 'admin';
-    created_at: number;
-    updated_at: number;
-  }
+  export type User = NonNullable<Awaited<ReturnType<BaseDurableAgentBuilder['getUserById']>>>;
 
   export interface Provider {
     name: string;
@@ -36755,6 +36797,7 @@ var PUBLIC_ROUTES = /* @__PURE__ */ new Set([
   "/api/auth/bootstrap",
   "/api/auth/login",
   "/api/auth/config",
+  "/api/auth/exchange",
   "/api/auth/brolly-control",
   "/api/auth/platform-cleanup",
   "/api/auth/platform-replica",
@@ -38027,7 +38070,8 @@ async function loadVirtualModule(id, context) {
     installedProviders,
     rou3Code,
     hmr,
-    deviceApproval
+    deviceApproval,
+    keyExchange
   } = context;
   if (id === RESOLVED_VIRTUAL_TOOLS_ID) {
     const tools = await scanToolsDirectory(toolsDir);
@@ -38092,6 +38136,7 @@ export const config = {
   promptsDir: "${relativePromptsDir}",
   agentsDir: "${relativeAgentsDir}",
   deviceApproval: ${JSON.stringify(deviceApproval ?? null)},
+  keyExchange: ${JSON.stringify(keyExchange ?? null)},
 };`;
   }
   if (id === RESOLVED_VIRTUAL_MODELS_ID) {
@@ -38500,6 +38545,35 @@ function applyPluginEnvironmentConfig(config, options = {}) {
   }
 }
 
+// src/utils/key-exchange.ts
+var HOST_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function validHost(host) {
+  return host.length <= 253 && host.split(".").length >= 2 && host.split(".").every((label) => HOST_LABEL.test(label));
+}
+function normalizeTrustedOrigin(value) {
+  if (typeof value !== "string") {
+    throw new Error("keyExchange.trustedOrigins entries must be strings");
+  }
+  const entry = value.trim().toLowerCase();
+  const host = entry.startsWith("https://") ? entry.slice("https://".length) : "";
+  const wildcard = host.startsWith("*.");
+  if (!validHost(wildcard ? host.slice(2) : host)) {
+    throw new Error(`keyExchange.trustedOrigins entry ${JSON.stringify(value)} must be https://host or https://*.suffix`);
+  }
+  return entry;
+}
+function normalizeKeyExchange(value) {
+  if (value === void 0) return void 0;
+  if (!value || typeof value !== "object" || !Array.isArray(value.trustedOrigins)) {
+    throw new Error("keyExchange must be an object with a trustedOrigins array");
+  }
+  const trustedOrigins = [...new Set(value.trustedOrigins.map(normalizeTrustedOrigin))];
+  if (trustedOrigins.length === 0) {
+    throw new Error("keyExchange.trustedOrigins must name at least one origin");
+  }
+  return { trustedOrigins };
+}
+
 // src/plugin/device-approval.ts
 function requiredText(value, field, maxLength) {
   if (typeof value !== "string" || !value.trim() || value.trim().length > maxLength) {
@@ -38544,6 +38618,7 @@ function normalizeDeviceApprovalBrand(value) {
 // src/plugin.ts
 function agentbuilder(options = {}) {
   const deviceApproval = normalizeDeviceApprovalBrand(options.deviceApproval);
+  const keyExchange = normalizeKeyExchange(options.keyExchange);
   const trustedDevHosts = normalizeTrustedDevHosts(options.trustedDevHosts);
   const toolsDir = options.toolsDir ? path9__default.resolve(process.cwd(), options.toolsDir) : path9__default.resolve(process.cwd(), "agents/tools");
   const hooksDir = options.hooksDir ? path9__default.resolve(process.cwd(), options.hooksDir) : path9__default.resolve(process.cwd(), "agents/hooks");
@@ -38640,7 +38715,8 @@ export { CodeExecutionBridge, DurableAgentBuilder, DurableThread, ThreadWatchdog
     installedProviders,
     rou3Code,
     hmr,
-    deviceApproval
+    deviceApproval,
+    keyExchange
   };
   const devMiddlewareContext = {
     toolsDir,
@@ -38877,12 +38953,13 @@ function runtimePreflightResponse(request, env) {
 // src/middleware/auth.ts
 function endpointCallerFromAuth(auth) {
   if (!auth) return null;
-  const { id, username, role, permissions, email, display_name, avatar_url } = auth.user;
+  const { id, username, role, permissions, roles, email, display_name, avatar_url } = auth.user;
   return {
     id,
     username,
     role,
     permissions: permissions ?? null,
+    roles: roles ?? [],
     email: email ?? null,
     display_name: display_name ?? null,
     avatar_url: avatar_url ?? null
@@ -38928,6 +39005,8 @@ function parseWebSocketTicketAuth(authJson) {
   if (typeof user.id !== "string" || typeof user.username !== "string" || typeof user.role !== "string" || record.authType !== "super_admin" && record.authType !== "session" && record.authType !== "api_key") {
     return null;
   }
+  const roles = user.roles;
+  if (roles !== void 0 && (!Array.isArray(roles) || !roles.every((role) => typeof role === "string"))) return null;
   const permissions = user.permissions;
   if (permissions !== void 0 && permissions !== null && (!Array.isArray(permissions) || !permissions.every((permission) => typeof permission === "string"))) {
     return null;
@@ -38939,6 +39018,7 @@ function parseWebSocketTicketAuth(authJson) {
       username: user.username,
       role: user.role,
       permissions,
+      roles: Array.isArray(roles) ? roles : [],
       platform_user_id: typeof user.platform_user_id === "string" ? user.platform_user_id : null,
       email: typeof user.email === "string" ? user.email : null,
       display_name: typeof user.display_name === "string" ? user.display_name : null,
@@ -38962,7 +39042,19 @@ async function consumeWebSocketTicket(request, env) {
     ticket_hash: await hashToken(ticket),
     pathname: url.pathname
   });
-  return typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+  const context = typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+  if (!context || context.authType === "super_admin") return context;
+  const user = await getAgentBuilder(env).getUserById(context.user.id);
+  if (!user) return null;
+  return {
+    ...context,
+    user: {
+      ...context.user,
+      role: user.role,
+      permissions: parsePermissions(user.permissions),
+      roles: user.roles ?? []
+    }
+  };
 }
 async function authenticate(request, env) {
   const ticketAuth = await consumeWebSocketTicket(request, env);
@@ -38985,7 +39077,8 @@ async function authenticate(request, env) {
             user: {
               id: "super_admin",
               username: "admin",
-              role: "admin"
+              role: "admin",
+              roles: []
             },
             authType: "super_admin"
           };
@@ -39006,6 +39099,7 @@ async function authenticate(request, env) {
             username: user.username,
             role: user.role,
             permissions: parsePermissions(user.permissions),
+            roles: user.roles ?? [],
             platform_user_id: user.platform_user_id ?? null,
             email: user.email ?? null,
             display_name: user.display_name ?? null,
@@ -39029,6 +39123,7 @@ async function authenticate(request, env) {
             username: user.username,
             role: user.role,
             permissions: parsePermissions(user.permissions),
+            roles: user.roles ?? [],
             platform_user_id: user.platform_user_id ?? null,
             email: user.email ?? null,
             display_name: user.display_name ?? null,
@@ -39432,6 +39527,7 @@ var UserStateImpl = class {
       username: user.username,
       role: user.role,
       permissions: user.permissions ?? null,
+      roles: user.roles ?? [],
       email: user.email ?? null,
       display_name: user.display_name ?? null,
       avatar_url: user.avatar_url ?? null