@standardagents/builder 0.41.16 → 0.41.17

package/dist/{index-BrQgCoFh.d.ts → index-C82dLGPq.d.ts}

@@ -1190,6 +1190,8 @@ interface AuthUser {
      * no explicit set — see {@link hasPermission} for the fallback rules.
      */
     permissions?: string[] | null;
+    /** Application roles, independent of built-in instance permissions. */
+    roles?: string[];
     platform_user_id?: string | null;
     email?: string | null;
     display_name?: string | null;
@@ -1609,6 +1611,7 @@ interface AuthenticationUser {
     password_hash: string;
     role: 'admin' | 'user' | 'api';
     permissions?: string | null;
+    roles?: string[];
     platform_user_id?: string | null;
     email?: string | null;
     display_name?: string | null;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { M as ModelDefinition, A as AgentDefinition } from './resolver-CWWRzZU1.js';
-export { m as AgentBuilderEnv, n as AgentBuilderEvent, ah as BroadcastOptions, C as CodeExecutionBridge, h as DurableAgentBuilder, D as DurableThread, l as DurableUserHub, af as FlowStateSdk, ai as FlowStateWithSdk, G as HandlerSide, H as HubClientInfo, E as HumanSide, aq as ImageContextConfig, ae as InjectMessageOptions, as as LLMProviderInterface, aL as NamespaceResolutionError, w as PromptContent, s as PromptDefinition, y as PromptIncludePart, x as PromptPart, F as PromptSide, t as PromptToolConfig, P as Provider, at as ProviderContentPart, aw as ProviderFilePart, av as ProviderImagePart, ar as ProviderRegistry, au as ProviderTextPart, B as SessionToolBinding, z as SessionToolConfig, I as SideConfig, J as SubagentRelationship, u as SubagentToolConfig, S as SubpromptConfig, o as ThreadEventPayload, p as ThreadRegistryEntry, T as ThreadWatchdog, j as ThreadWatchdogState, v as ToolConfig, U as UpdateThreadParams, q as User, k as WatchdogCheckin, W as WatchdogProbeResult, f as applyRuntimeCors, am as buildImageDescription, c as canAccessThread, a9 as cat, aJ as createNamespaceContext, Q as emitThreadEvent, ag as enhanceFlowState, a0 as exists, ad as find, R as forceTurn, ap as generateImageDescription, a7 as getFileStats, N as getMessages, al as getMessagesToSummarize, az as getShortName, a8 as getThumbnail, ak as getUnsummarizedImageAttachments, aG as getVisibleAgentNames, aI as getVisibleModelNames, aH as getVisiblePromptNames, aF as getVisibleToolNames, ac as grep, aj as hasImageAttachments, aa as head, L as injectMessage, d as isAdminOnlyApiRoute, i as isHostedInstance, b as isPublicApiRoute, aK as isQualifiedName, e as isSameOriginBrowserRequest, a as isTrustedLocalDevelopmentRequest, Z as linkFile, a2 as mkdir, a5 as move, ao as optimizeImageContext, ax as parseQualifiedName, ay as qualifyName, K as queueTool, _ as readFile, a3 as readdir, O as reloadHistory, a6 as rename, an as replaceImagesWithDescriptions, aD as resolveAgent, aE as resolveHook, aC as resolveModel, aB as resolvePrompt, aA as resolveTool, a4 as rmdir, r as runtimeCorsHeaders, g as runtimePreflightResponse, $ as stat, ab as tail, a1 as unlink, V as updateThread, X as writeFile, Y as writeImage } from './resolver-CWWRzZU1.js';
+import { M as ModelDefinition, A as AgentDefinition } from './resolver-eygn_O1w.js';
+export { m as AgentBuilderEnv, n as AgentBuilderEvent, ah as BroadcastOptions, C as CodeExecutionBridge, h as DurableAgentBuilder, D as DurableThread, l as DurableUserHub, af as FlowStateSdk, ai as FlowStateWithSdk, G as HandlerSide, H as HubClientInfo, E as HumanSide, aq as ImageContextConfig, ae as InjectMessageOptions, as as LLMProviderInterface, aL as NamespaceResolutionError, w as PromptContent, s as PromptDefinition, y as PromptIncludePart, x as PromptPart, F as PromptSide, t as PromptToolConfig, P as Provider, at as ProviderContentPart, aw as ProviderFilePart, av as ProviderImagePart, ar as ProviderRegistry, au as ProviderTextPart, B as SessionToolBinding, z as SessionToolConfig, I as SideConfig, J as SubagentRelationship, u as SubagentToolConfig, S as SubpromptConfig, o as ThreadEventPayload, p as ThreadRegistryEntry, T as ThreadWatchdog, j as ThreadWatchdogState, v as ToolConfig, U as UpdateThreadParams, q as User, k as WatchdogCheckin, W as WatchdogProbeResult, f as applyRuntimeCors, am as buildImageDescription, c as canAccessThread, a9 as cat, aJ as createNamespaceContext, Q as emitThreadEvent, ag as enhanceFlowState, a0 as exists, ad as find, R as forceTurn, ap as generateImageDescription, a7 as getFileStats, N as getMessages, al as getMessagesToSummarize, az as getShortName, a8 as getThumbnail, ak as getUnsummarizedImageAttachments, aG as getVisibleAgentNames, aI as getVisibleModelNames, aH as getVisiblePromptNames, aF as getVisibleToolNames, ac as grep, aj as hasImageAttachments, aa as head, L as injectMessage, d as isAdminOnlyApiRoute, i as isHostedInstance, b as isPublicApiRoute, aK as isQualifiedName, e as isSameOriginBrowserRequest, a as isTrustedLocalDevelopmentRequest, Z as linkFile, a2 as mkdir, a5 as move, ao as optimizeImageContext, ax as parseQualifiedName, ay as qualifyName, K as queueTool, _ as readFile, a3 as readdir, O as reloadHistory, a6 as rename, an as replaceImagesWithDescriptions, aD as resolveAgent, aE as resolveHook, aC as resolveModel, aB as resolvePrompt, aA as resolveTool, a4 as rmdir, r as runtimeCorsHeaders, g as runtimePreflightResponse, $ as stat, ab as tail, a1 as unlink, V as updateThread, X as writeFile, Y as writeImage } from './resolver-eygn_O1w.js';
 export { AgentPluginOptions, agentbuilder, builder } from './plugin.js';
-export { v as Agent, J as AttachmentRef, i as AuthContext, A as AuthUser, e as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, p as ClientStreamRequest, q as ClientStreamResponse, n as ClientToolRequest, o as ClientToolResponse, B as Controller, a as ControllerContext, G as Env, H as FileRecord, N as FileStats, D as FlowResult, F as FlowState, K as GrepResult, P as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, U as MessageContent, Q as MultimodalContent, R as RequestContext, S as StorageBackend, E as TelemetryEvent, O as TextContentPart, T as ThreadEndpointContext, b as ThreadEnv, w as ThreadInstance, x as ThreadMetadata, y as ToolCall, z as ToolResult, f as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as endpointCallerFromAuth, g as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-BrQgCoFh.js';
+export { v as Agent, J as AttachmentRef, i as AuthContext, A as AuthUser, e as BuilderThreadEndpointHandler, C as CLIENT_STREAM_CHUNK_BYTES, t as ClientDuplex, u as ClientForwarding, p as ClientStreamRequest, q as ClientStreamResponse, n as ClientToolRequest, o as ClientToolResponse, B as Controller, a as ControllerContext, G as Env, H as FileRecord, N as FileStats, D as FlowResult, F as FlowState, K as GrepResult, P as ImageContentPart, I as ImageMetadata, L as LLMResponse, M as Message, U as MessageContent, Q as MultimodalContent, R as RequestContext, S as StorageBackend, E as TelemetryEvent, O as TextContentPart, T as ThreadEndpointContext, b as ThreadEnv, w as ThreadInstance, x as ThreadMetadata, y as ToolCall, z as ToolResult, f as authenticate, j as callClient, k as callClientStream, c as createThreadEndpointHandler, m as decodeStreamChunk, d as defineController, l as encodeStreamChunk, h as endpointCallerFromAuth, g as requireAdmin, r as requireAuth, s as supportsClientForwarding } from './index-C82dLGPq.js';
 export { AgentType, DefineHandlerOptions, DefinitionLoader, GlobalNamespaceContext, HANDLER_SYMBOL, HandlerDefinition, HookExecutionContext, HookExecutionSource, HookSignatures, ImageContent, ModelCapabilities, ModelProvider, NamespaceContext, PackageSignature, PackedExports, PackedMeta, PackedMetadata, PackedNamespaceContext, ParentHookRequirement, ParentHookStage, PromptInput, PromptTextPart, ProviderAssistantMessage, ProviderConfigSlot, ProviderConfigSlots, ProviderConfigValueSource, ProviderDefinition, ProviderError, ProviderErrorCode, ProviderFactory, ProviderFactoryConfig, ProviderFinishReason, ProviderGeneratedImage, ProviderMessage, ProviderMessageContent, ProviderMethodOverrides, ModelCapabilities as ProviderModelCapabilities, ProviderOverride, ProviderOverrideContext, ProviderReasoningDetail, ProviderRequest, ProviderResponse, ProviderStreamChunk, ProviderSyncOverride, ProviderSystemMessage, ProviderTool, ProviderToolCallPart, ProviderToolMessage, ProviderToolResultContent, ProviderUsage, ProviderUserMessage, ReasoningConfig, StructuredPrompt, TextContent, ThreadHookName, Tool, ToolArgs, ToolArgsNode, ToolArgsRawShape, ToolContent, belongsToPackage, defineAgent, defineHandler, defineHook, defineModel, definePrompt, defineProvider, defineTool, isHandler, isPacked, isVisibleInNamespace, mapReasoningLevel, providerConst, providerEnv, providerValue } from '@standardagents/spec';
 export { C as ConstituentItem, D as DiscoveredPackage, N as NamespacedRegistry, P as PackingAnalysis, a as PackingOptions, b as PackingResult, U as UnpackOptions, c as UnpackResult } from './types-Dhd0M369.js';
 export { D as DiscoveryConfig, P as PackageDiscoveryService, d as discoverPackages } from './discovery-D5pmuazY.js';

package/dist/index.js

@@ -10329,6 +10329,24 @@ var init_platform_handoff_jtis = __esm({
   }
 });
 
+// src/durable-objects/agentbuilder-migrations/0022_application_roles.ts
+var migration60;
+var init_application_roles = __esm({
+  "src/durable-objects/agentbuilder-migrations/0022_application_roles.ts"() {
+    migration60 = {
+      version: 22,
+      async up(sql) {
+        sql.exec(`CREATE TABLE platform_application_roles (
+      platform_user_id TEXT PRIMARY KEY,
+      roles TEXT NOT NULL DEFAULT '[]',
+      roles_version INTEGER NOT NULL DEFAULT 0
+    )`);
+        sql.exec(`INSERT OR REPLACE INTO _metadata (key, value) VALUES ('schema_version', '22')`);
+      }
+    };
+  }
+});
+
 // src/durable-objects/agentbuilder-migrations/index.ts
 var migrations2, LATEST_SCHEMA_VERSION2;
 var init_agentbuilder_migrations = __esm({
@@ -10354,9 +10372,10 @@ var init_agentbuilder_migrations = __esm({
     init_scope_skills();
     init_websocket_tickets();
     init_platform_handoff_jtis();
-    migrations2 = [migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52, migration53, migration54, migration55, migration56, migration57, migration58, migration59];
+    init_application_roles();
+    migrations2 = [migration39, migration40, migration41, migration42, migration43, migration44, migration45, migration46, migration47, migration48, migration49, migration50, migration51, migration52, migration53, migration54, migration55, migration56, migration57, migration58, migration59, migration60];
     LATEST_SCHEMA_VERSION2 = migrations2.reduce(
-      (max, migration60) => Math.max(max, migration60.version),
+      (max, migration61) => Math.max(max, migration61.version),
       0
     );
   }
@@ -11165,9 +11184,9 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         }
       }
       async runMigrations(fromVersion) {
-        for (const migration60 of migrations2) {
-          if (migration60.version > fromVersion) {
-            await migration60.up(this.ctx.storage.sql);
+        for (const migration61 of migrations2) {
+          if (migration61.version > fromVersion) {
+            await migration61.up(this.ctx.storage.sql);
           }
         }
       }
@@ -12722,6 +12741,7 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           // admin meaning.
           role: row.role === "user" ? "user" : row.role === "api" ? "api" : "admin",
           permissions: parseStoredPermissions(row.permissions),
+          roles: parseStoredPermissions(row.roles) ?? [],
           platform_user_id: row.platform_user_id ?? null,
           email: row.email ?? null,
           display_name: row.display_name ?? null,
@@ -12739,7 +12759,8 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         await this.ensureMigrated();
         const cursor = await this.ctx.storage.sql.exec(
           `SELECT id, username, password_hash, COALESCE(instance_role, role) AS role,
-        permissions, platform_user_id, email, display_name, avatar_url, source, replica_active,
+        permissions, (SELECT roles FROM platform_application_roles WHERE platform_user_id = users.platform_user_id) AS roles,
+        platform_user_id, email, display_name, avatar_url, source, replica_active,
         created_at, updated_at
        FROM users WHERE username = ? AND deleted_at IS NULL AND replica_active != 0`,
           username
@@ -12755,7 +12776,8 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         await this.ensureMigrated();
         const cursor = await this.ctx.storage.sql.exec(
           `SELECT id, username, password_hash, COALESCE(instance_role, role) AS role,
-        permissions, platform_user_id, email, display_name, avatar_url, source, replica_active,
+        permissions, (SELECT roles FROM platform_application_roles WHERE platform_user_id = users.platform_user_id) AS roles,
+        platform_user_id, email, display_name, avatar_url, source, replica_active,
         created_at, updated_at
        FROM users WHERE id = ? AND deleted_at IS NULL AND replica_active != 0`,
           id
@@ -12799,6 +12821,7 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           password_hash: params.password_hash,
           role: params.role || "admin",
           permissions: params.permissions ?? null,
+          roles: [],
           platform_user_id: params.platform_user_id ?? null,
           email: params.email ?? null,
           display_name: params.display_name ?? null,
@@ -12932,11 +12955,31 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         );
         return true;
       }
-      /**
-       * Upsert a platform-replicated identity and return the local user row.
-       */
+      /** Apply an authoritative role replacement while retaining revocation fences. */
+      applyApplicationRoles(platformUserId, roles, version, revoke = false) {
+        const revision = version === void 0 ? 0 : version;
+        if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 0) {
+          throw new Error("Invalid application roles revision");
+        }
+        if (roles !== void 0 && (!Array.isArray(roles) || !roles.every((role) => typeof role === "string"))) {
+          throw new Error("Invalid application roles");
+        }
+        this.ctx.storage.sql.exec(
+          `INSERT INTO platform_application_roles (platform_user_id, roles, roles_version)
+       VALUES (?, ?, ?)
+       ON CONFLICT(platform_user_id) DO UPDATE SET roles = excluded.roles, roles_version = excluded.roles_version
+       WHERE excluded.roles_version > platform_application_roles.roles_version
+          OR (? = 1 AND excluded.roles_version = platform_application_roles.roles_version)`,
+          platformUserId,
+          JSON.stringify(roles ?? []),
+          revision,
+          revoke ? 1 : 0
+        );
+      }
+      /** Upsert a platform-replicated identity and return the local user row. */
       async upsertPlatformReplicaUser(replica) {
         await this.ensureMigrated();
+        this.applyApplicationRoles(replica.platform_user_id, replica.roles, replica.roles_version);
         const now = Math.floor(Date.now() / 1e3);
         const fallback = this.normalizeReplicaUsername(
           replica.email?.split("@")[0] ?? null,
@@ -12983,7 +13026,7 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           }
           return updated;
         }
-        return this.createUser({
+        const created = await this.createUser({
           username: availableUsername,
           password_hash: `platform-replica:${crypto.randomUUID()}`,
           role: replica.role,
@@ -12994,12 +13037,18 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
           avatar_url: replica.avatar_url ?? null,
           source: "standard_agents"
         });
+        const user = await this.getUserById(created.id);
+        if (!user) throw new Error("Failed to load replicated user after creation");
+        return user;
       }
       /**
        * Apply a full platform read-replica snapshot for this instance.
        */
       async applyPlatformReplicaSnapshot(snapshot) {
         await this.ensureMigrated();
+        for (const revocation of snapshot.role_revocations ?? []) {
+          this.applyApplicationRoles(revocation.platform_user_id, [], revocation.roles_version, true);
+        }
         const activeUserIds = /* @__PURE__ */ new Set();
         for (const replicaUser of snapshot.users) {
           const user = await this.upsertPlatformReplicaUser(replicaUser);
@@ -13052,10 +13101,9 @@ ${result ?? error ?? "No result content."}${attachmentSummary}`;
         const keys = snapshot.api_keys ?? [];
         for (const key of keys) {
           const user = key.user_platform_id ? await this.getUserByPlatformUserId(key.user_platform_id) : await this.getFirstReplicaAdminUser();
-          const keyUser = user ?? await this.getFirstReplicaAdminUser();
-          if (!keyUser) continue;
+          if (!user) continue;
           activePlatformKeyIds.add(key.id);
-          await this.upsertPlatformReplicaApiKey(key, keyUser.id);
+          await this.upsertPlatformReplicaApiKey(key, user.id);
         }
         const now = Math.floor(Date.now() / 1e3);
         if (activePlatformKeyIds.size > 0) {
@@ -17667,9 +17715,9 @@ var init_DurableThread = __esm({
        * Each migration is run in order, starting from the current version + 1.
        */
       async runMigrations(fromVersion) {
-        for (const migration60 of migrations) {
-          if (migration60.version > fromVersion) {
-            await migration60.up(this.ctx.storage.sql);
+        for (const migration61 of migrations) {
+          if (migration61.version > fromVersion) {
+            await migration61.up(this.ctx.storage.sql);
           }
         }
       }
@@ -29547,6 +29595,7 @@ var init_ThreadStateImpl = __esm({
           username: user.username,
           role: user.role,
           permissions: user.permissions ?? null,
+          roles: user.roles ?? [],
           email: user.email ?? null,
           display_name: user.display_name ?? null,
           avatar_url: user.avatar_url ?? null
@@ -30241,14 +30290,7 @@ declare module 'virtual:@standardagents/builder' {
     terminated?: number | null;
   }
 
-  export interface User {
-    id: string;
-    username: string;
-    password_hash: string;
-    role: 'admin';
-    created_at: number;
-    updated_at: number;
-  }
+  export type User = NonNullable<Awaited<ReturnType<BaseDurableAgentBuilder['getUserById']>>>;
 
   export interface Provider {
     name: string;
@@ -38911,12 +38953,13 @@ function runtimePreflightResponse(request, env) {
 // src/middleware/auth.ts
 function endpointCallerFromAuth(auth) {
   if (!auth) return null;
-  const { id, username, role, permissions, email, display_name, avatar_url } = auth.user;
+  const { id, username, role, permissions, roles, email, display_name, avatar_url } = auth.user;
   return {
     id,
     username,
     role,
     permissions: permissions ?? null,
+    roles: roles ?? [],
     email: email ?? null,
     display_name: display_name ?? null,
     avatar_url: avatar_url ?? null
@@ -38962,6 +39005,8 @@ function parseWebSocketTicketAuth(authJson) {
   if (typeof user.id !== "string" || typeof user.username !== "string" || typeof user.role !== "string" || record.authType !== "super_admin" && record.authType !== "session" && record.authType !== "api_key") {
     return null;
   }
+  const roles = user.roles;
+  if (roles !== void 0 && (!Array.isArray(roles) || !roles.every((role) => typeof role === "string"))) return null;
   const permissions = user.permissions;
   if (permissions !== void 0 && permissions !== null && (!Array.isArray(permissions) || !permissions.every((permission) => typeof permission === "string"))) {
     return null;
@@ -38973,6 +39018,7 @@ function parseWebSocketTicketAuth(authJson) {
       username: user.username,
       role: user.role,
       permissions,
+      roles: Array.isArray(roles) ? roles : [],
       platform_user_id: typeof user.platform_user_id === "string" ? user.platform_user_id : null,
       email: typeof user.email === "string" ? user.email : null,
       display_name: typeof user.display_name === "string" ? user.display_name : null,
@@ -38996,7 +39042,19 @@ async function consumeWebSocketTicket(request, env) {
     ticket_hash: await hashToken(ticket),
     pathname: url.pathname
   });
-  return typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+  const context = typeof authJson === "string" ? parseWebSocketTicketAuth(authJson) : null;
+  if (!context || context.authType === "super_admin") return context;
+  const user = await getAgentBuilder(env).getUserById(context.user.id);
+  if (!user) return null;
+  return {
+    ...context,
+    user: {
+      ...context.user,
+      role: user.role,
+      permissions: parsePermissions(user.permissions),
+      roles: user.roles ?? []
+    }
+  };
 }
 async function authenticate(request, env) {
   const ticketAuth = await consumeWebSocketTicket(request, env);
@@ -39019,7 +39077,8 @@ async function authenticate(request, env) {
             user: {
               id: "super_admin",
               username: "admin",
-              role: "admin"
+              role: "admin",
+              roles: []
             },
             authType: "super_admin"
           };
@@ -39040,6 +39099,7 @@ async function authenticate(request, env) {
             username: user.username,
             role: user.role,
             permissions: parsePermissions(user.permissions),
+            roles: user.roles ?? [],
             platform_user_id: user.platform_user_id ?? null,
             email: user.email ?? null,
             display_name: user.display_name ?? null,
@@ -39063,6 +39123,7 @@ async function authenticate(request, env) {
             username: user.username,
             role: user.role,
             permissions: parsePermissions(user.permissions),
+            roles: user.roles ?? [],
             platform_user_id: user.platform_user_id ?? null,
             email: user.email ?? null,
             display_name: user.display_name ?? null,
@@ -39466,6 +39527,7 @@ var UserStateImpl = class {
       username: user.username,
       role: user.role,
       permissions: user.permissions ?? null,
+      roles: user.roles ?? [],
       email: user.email ?? null,
       display_name: user.display_name ?? null,
       avatar_url: user.avatar_url ?? null