@standardagents/builder 0.41.16 → 0.41.17

package/dist/built-in-routes.js

@@ -9948,6 +9948,24 @@ var init_platform_handoff_jtis = __esm({
   }
 });
 
+// src/durable-objects/agentbuilder-migrations/0022_application_roles.ts
+var migration60;
+var init_application_roles = __esm({
+  "src/durable-objects/agentbuilder-migrations/0022_application_roles.ts"() {
+    migration60 = {
+      version: 22,
+      async up(sql) {
+        sql.exec(`CREATE TABLE platform_application_roles (
+      platform_user_id TEXT PRIMARY KEY,
+      roles TEXT NOT NULL DEFAULT '[]',
+      roles_version INTEGER NOT NULL DEFAULT 0
+    )`);
+        sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '22')`);
+      }
+    };
+  }
+});
+
 // src/durable-objects/agentbuilder-migrations/index.ts
 var migrations2;
 var init_agentbuilder_migrations = __esm({
@@ -9973,9 +9991,10 @@ var init_agentbuilder_migrations = __esm({
     init_scope_skills();
     init_websocket_tickets();
     init_platform_handoff_jtis();
-    migrations2 = [migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52, migration53, migration54, migration55, migration56, migration57, migration58, migration59];
+    init_application_roles();
+    migrations2 = [migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52, migration53, migration54, migration55, migration56, migration57, migration58, migration59, migration60];
     migrations2.reduce(
-      (max, migration60) => Math.max(max, migration60.version),
+      (max, migration61) => Math.max(max, migration61.version),
       0
     );
   }
@@ -13781,9 +13800,9 @@ var init_DurableThread = __esm({
        * Each migration is run in order, starting from the current version + 1.
        */
       async runMigrations(fromVersion) {
-        for (const migration60 of migrations) {
-          if (migration60.version > fromVersion) {
-            await migration60.up(this.ctx.storage.sql);
+        for (const migration61 of migrations) {
+          if (migration61.version > fromVersion) {
+            await migration61.up(this.ctx.storage.sql);
           }
         }
       }
@@ -25378,6 +25397,7 @@ var init_ThreadStateImpl = __esm({
           username: user.username,
           role: user.role,
           permissions: user.permissions ?? null,
+          roles: user.roles ?? [],
           email: user.email ?? null,
           display_name: user.display_name ?? null,
           avatar_url: user.avatar_url ?? null
@@ -78945,6 +78965,8 @@ function parseWebSocketTicketAuth(authJson) {
   if (typeof user.id !== "string" || typeof user.username !== "string" || typeof user.role !== "string" || record24.authType !== "super_admin" && record24.authType !== "session" && record24.authType !== "api_key") {
     return null;
   }
+  const roles = user.roles;
+  if (roles !== void 0 && (!Array.isArray(roles) || !roles.every((role) => typeof role === "string"))) return null;
   const permissions = user.permissions;
   if (permissions !== void 0 && permissions !== null && (!Array.isArray(permissions) || !permissions.every((permission) => typeof permission === "string"))) {
     return null;
@@ -78956,6 +78978,7 @@ function parseWebSocketTicketAuth(authJson) {
       username: user.username,
       role: user.role,
       permissions,
+      roles: Array.isArray(roles) ? roles : [],
       platform_user_id: typeof user.platform_user_id === "string" ? user.platform_user_id : null,
       email: typeof user.email === "string" ? user.email : null,
       display_name: typeof user.display_name === "string" ? user.display_name : null,
@@ -78979,7 +79002,19 @@ async function consumeWebSocketTicket(request, env2) {
     ticket_hash: await hashToken(ticket),
     pathname: url.pathname
   });
-  return typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+  const context = typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+  if (!context || context.authType === "super_admin") return context;
+  const user = await getAgentBuilder(env2).getUserById(context.user.id);
+  if (!user) return null;
+  return {
+    ...context,
+    user: {
+      ...context.user,
+      role: user.role,
+      permissions: parsePermissions(user.permissions),
+      roles: user.roles ?? []
+    }
+  };
 }
 function isWebSocketTicketPath(pathname) {
   if (!pathname.startsWith("/api/") || pathname.includes("?") || pathname.includes("#")) return false;
@@ -79010,7 +79045,8 @@ async function authenticate(request, env2) {
             user: {
               id: "super_admin",
               username: "admin",
-              role: "admin"
+              role: "admin",
+              roles: []
             },
             authType: "super_admin"
           };
@@ -79031,6 +79067,7 @@ async function authenticate(request, env2) {
             username: user.username,
             role: user.role,
             permissions: parsePermissions(user.permissions),
+            roles: user.roles ?? [],
             platform_user_id: user.platform_user_id ?? null,
             email: user.email ?? null,
             display_name: user.display_name ?? null,
@@ -79054,6 +79091,7 @@ async function authenticate(request, env2) {
             username: user.username,
             role: user.role,
             permissions: parsePermissions(user.permissions),
+            roles: user.roles ?? [],
             platform_user_id: user.platform_user_id ?? null,
             email: user.email ?? null,
             display_name: user.display_name ?? null,
@@ -79332,6 +79370,8 @@ function normalizeLocalBootstrap(payload, endpoint) {
       id: platformUserId,
       username,
       role,
+      roles: Array.isArray(payload.user?.roles) && payload.user.roles.every((role2) => typeof role2 === "string") ? payload.user.roles : [],
+      roles_version: typeof payload.user?.roles_version === "number" ? payload.user.roles_version : 0,
       email: typeof payload.user?.email === "string" ? payload.user.email : null,
       display_name: typeof payload.user?.display_name === "string" ? payload.user.display_name : null,
       avatar_url: typeof payload.user?.avatar_url === "string" ? payload.user.avatar_url : null,
@@ -79389,7 +79429,9 @@ async function upsertReplicaUserForPlatformProfile(env2, profile) {
     email: profile.email ?? null,
     avatar_url: profile.avatar_url ?? null,
     role: profile.role ?? "admin",
-    permissions: profile.permissions ?? null
+    permissions: profile.permissions ?? null,
+    roles: profile.roles ?? [],
+    roles_version: profile.roles_version
   });
 }
 async function mintLocalSessionForPlatformUser(env2, platformUser) {
@@ -79403,7 +79445,7 @@ async function mintLocalSessionForPlatformUser(env2, platformUser) {
   const tokenHash = await hashToken(token);
   const expiresAt = Math.floor(Date.now() / 1e3) + SESSION_TTL_SECONDS;
   await agentBuilder.createSession({ user_id: user.id, token_hash: tokenHash, expires_at: expiresAt });
-  return { token, user: { id: user.id, username: user.username, role: user.role } };
+  return { token, user: { id: user.id, username: user.username, role: user.role, roles: user.roles ?? [] } };
 }
 async function consumePlatformHandoffJti(env2, jti, expiresAt) {
   return agentBuilderAuthStub(env2).consumePlatformHandoffJti({
@@ -79431,7 +79473,9 @@ async function createPlatformLocalSession(request, env2) {
     display_name: identity.user.display_name ?? null,
     email: identity.user.email ?? null,
     avatar_url: identity.user.avatar_url ?? null,
-    role: identity.user.role
+    role: identity.user.role,
+    roles: identity.user.roles ?? [],
+    roles_version: identity.user.roles_version
   });
   const token = generateUserToken();
   const tokenHash = await hashToken(token);
@@ -79446,7 +79490,8 @@ async function createPlatformLocalSession(request, env2) {
     user: {
       id: user.id,
       username: user.username,
-      role: user.role
+      role: user.role,
+      roles: user.roles ?? []
     },
     authType: "platform_token",
     platform: identity
@@ -79698,7 +79743,7 @@ var config_get_default = defineController2(async ({ config, env: env2, req }) =>
 });
 
 // src/version.ts
-var BUILDER_VERSION = "0.41.16".length > 0 ? "0.41.16" : "dev";
+var BUILDER_VERSION = "0.41.17".length > 0 ? "0.41.17" : "dev";
 
 // src/api/diagnostics.get.ts
 init_LLMRequest();
@@ -82466,6 +82511,7 @@ var platform_replica_post_default = defineController2(async ({ req, env: env2 })
   const agentBuilder = env2.AGENT_BUILDER.get(env2.AGENT_BUILDER.idFromName("singleton"));
   const result = await agentBuilder.applyPlatformReplicaSnapshot({
     users: payload.users,
+    role_revocations: payload.role_revocations,
     api_keys: payload.api_keys ?? []
   });
   return Response.json({ ok: true, ...result });
@@ -86320,7 +86366,9 @@ var callback_get_default = defineController2(async ({ req, env: env2 }) => {
     email: payload.email ?? null,
     avatar_url: payload.avatar_url ?? null,
     role: payload.role,
-    permissions: payload.permissions ?? null
+    permissions: payload.permissions ?? null,
+    roles: payload.roles ?? [],
+    roles_version: payload.roles_version
   });
   const returnTo = failReturnTo;
   const headers = new Headers({
@@ -86774,7 +86822,9 @@ async function resolveDeviceApprovalIdentity(req, env2) {
       email: payload.email ?? null,
       avatar_url: payload.avatar_url ?? null,
       role: payload.role,
-      permissions: payload.permissions ?? null
+      permissions: payload.permissions ?? null,
+      roles: payload.roles ?? [],
+      roles_version: payload.roles_version
     };
     return {
       confirmationSubject: `platform:${payload.platform_user_id}`,