@hotmeshio/long-tail 0.23.1 → 0.24.0

package/build/routes/bot-accounts.js

@@ -33,10 +33,18 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
+const capabilities_1 = require("../modules/capabilities");
 const api = __importStar(require("../api/bot-accounts"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
+/** Answer a refused decision with 403; true when the request may go on. */
+function allowed(decision, res) {
+    if (decision.allowed)
+        return true;
+    res.status(403).json({ error: decision.error });
+    return false;
+}
 // All bot account routes require admin access
 router.use(auth_1.requireBuilder);
 // ── Bot CRUD ─────────────────────────────────────────────────────────────────
@@ -69,6 +77,8 @@ router.get('/:id', async (req, res) => {
  */
 router.post('/', async (req, res) => {
     const { name, description, display_name, roles } = req.body || {};
+    if (!allowed(await (0, capabilities_1.mayGrantRoles)(req.auth.userId, roles), res))
+        return;
     const result = await api.createBot({ name, description, display_name, roles }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -78,6 +88,8 @@ router.post('/', async (req, res) => {
  * Body: { display_name?, description?, status? }
  */
 router.put('/:id', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.updateBot({ id: req.params.id, ...(req.body || {}) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -86,6 +98,8 @@ router.put('/:id', async (req, res) => {
  * Delete a bot account.
  */
 router.delete('/:id', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.deleteBot({ id: req.params.id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -105,6 +119,8 @@ router.get('/:id/roles', async (req, res) => {
  */
 router.post('/:id/roles', async (req, res) => {
     const { role, type } = req.body || {};
+    if (!allowed(await (0, capabilities_1.mayGrantRole)(req.auth.userId, { role, type }), res))
+        return;
     const result = await api.addBotRole({ id: req.params.id, role, type });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -113,6 +129,8 @@ router.post('/:id/roles', async (req, res) => {
  * Remove a role from a bot.
  */
 router.delete('/:id/roles/:role', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayRevokeRole)(req.auth.userId, String(req.params.id), String(req.params.role)), res))
+        return;
     const result = await api.removeBotRole({ id: req.params.id, role: req.params.role });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -132,6 +150,8 @@ router.get('/:id/api-keys', async (req, res) => {
  * Returns the raw key ONCE — it cannot be retrieved again.
  */
 router.post('/:id/api-keys', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const { name, scopes, expires_at } = req.body || {};
     const result = await api.createBotKey({
         id: req.params.id,
@@ -146,7 +166,10 @@ router.post('/:id/api-keys', async (req, res) => {
  * Revoke (delete) a bot API key.
  */
 router.delete('/:id/api-keys/:keyId', async (req, res) => {
-    const result = await api.revokeBotKey({ keyId: req.params.keyId });
+    const botId = String(req.params.id);
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, botId), res))
+        return;
+    const result = await api.revokeBotKey({ keyId: String(req.params.keyId), botId });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/capabilities.js

@@ -33,15 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/capabilities"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/capabilities
  * List all platform capabilities grouped by category.
  */
-router.get('/', async (_req, res) => {
-    const result = await api.listCapabilities();
+router.get('/', async (req, res) => {
+    const result = await api.listCapabilities(req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/controlplane.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/controlplane"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/controlplane/apps
  * List available HotMesh application namespaces.

package/build/routes/dba.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/dba"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/dba/prune
  * Prune expired jobs, streams, and execution artifacts.

package/build/routes/delegation.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const delegation_1 = require("../services/auth/delegation");
 const service_token_1 = require("../services/auth/service-token");
 const oauth_1 = require("../services/oauth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/delegation/oauth/:provider/token
  *

package/build/routes/diagnostics.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/diagnostics"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 const VALID_SECTIONS = new Set(['events', 'streams']);
 /** Parse a comma-separated `include` query param into the recognized heavy sections. */
 function parseInclude(raw) {

package/build/routes/docs.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 function projectRoot() {
     const candidates = [
         path.join(__dirname, '..'),

package/build/routes/domain.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/domain"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/domain
  * The deployment's domain dictionary: `{ doc, version, updated_at }`, or

package/build/routes/escalations/accumulate.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Open-accumulator routes. The literal single-segment paths are registered
  * before the parameterized routes so /:id never shadows them; the /:id/*

package/build/routes/escalations/acting.d.ts

@@ -1,4 +1,4 @@
-import type { Request, Response } from 'express';
+import type { Request, Response } from '../../lib/http';
 import type { LTApiAuth } from '../../types/sdk';
 /** The header a shared station device rides its badge grant on. */
 export declare const ACTING_TOKEN_HEADER = "x-lt-acting-token";

package/build/routes/escalations/analytics.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Escalation analytics HTTP surface — grouped membership/dwell aggregates and
  * per-entity timelines over the interval time-series. Read-only; the api layer

package/build/routes/escalations/bulk.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerBulkRoutes(router: Router): void;

package/build/routes/escalations/facets.d.ts

@@ -1,4 +1,4 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 /**
  * Faceted-routing HTTP surface — pond search + batch claim. Each operation targets a
  * single pond `role` and is RBAC-scoped to it (the api layer enforces the gate). These

package/build/routes/escalations/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const list_1 = require("./list");
 const bulk_1 = require("./bulk");
 const metadata_1 = require("./metadata");
@@ -9,7 +9,8 @@ const single_1 = require("./single");
 const resolve_1 = require("./resolve");
 const facets_1 = require("./facets");
 const analytics_1 = require("./analytics");
-const router = (0, express_1.Router)();
+const related_1 = require("./related");
+const router = (0, http_1.Router)();
 // Registration order matters: literal paths before parameterized /:id routes.
 // GET /, /available, /types, /stats
 (0, list_1.registerListRoutes)(router);
@@ -26,6 +27,8 @@ const router = (0, express_1.Router)();
 (0, facets_1.registerFacetRoutes)(router);
 // POST /aggregate-by-facets, /timeline-by-facet
 (0, analytics_1.registerAnalyticsRoutes)(router);
+// POST /related, /related/rows
+(0, related_1.registerRelatedRoutes)(router);
 // PATCH /:id/escalate, GET /by-workflow/:workflowId,
 // GET /:id, POST /:id/claim, POST /:id/release
 (0, single_1.registerSingleRoutes)(router);

package/build/routes/escalations/list.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerListRoutes(router: Router): void;

package/build/routes/escalations/list.js

@@ -110,6 +110,7 @@ function registerListRoutes(router) {
             available: req.query.available != null ? req.query.available === 'true' : undefined,
             jeopardy: req.query.jeopardy === '1' || req.query.jeopardy === 'true' || undefined,
             include: req.query.include,
+            groupBy: req.query.groupBy || undefined,
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
@@ -138,6 +139,7 @@ function registerListRoutes(router) {
             orderBy: jsonParam(req.query.orderBy),
             jeopardy: req.query.jeopardy === '1' || req.query.jeopardy === 'true' || undefined,
             include: req.query.include,
+            groupBy: req.query.groupBy || undefined,
         }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });

package/build/routes/escalations/metadata.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Register metadata-based escalation lookup routes.
  * Must be registered BEFORE parameterized /:id routes.

package/build/routes/escalations/related.d.ts

@@ -0,0 +1,7 @@
+import type { Router } from '../../lib/http';
+/**
+ * Related sets for role list views. The role's stored list schema declares
+ * the sets; the caller names the role, the page's host rows, and the schema
+ * version it rendered. Results are scoped to the caller's read scope.
+ */
+export declare function registerRelatedRoutes(router: Router): void;

package/build/routes/escalations/related.js

@@ -0,0 +1,60 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRelatedRoutes = registerRelatedRoutes;
+const api = __importStar(require("../../api/escalations"));
+/**
+ * Related sets for role list views. The role's stored list schema declares
+ * the sets; the caller names the role, the page's host rows, and the schema
+ * version it rendered. Results are scoped to the caller's read scope.
+ */
+function registerRelatedRoutes(router) {
+    /**
+     * POST /api/escalations/related
+     * Body: { role, ids, version? }
+     */
+    router.post('/related', async (req, res) => {
+        const result = await api.getRelatedAggregates(req.body ?? {}, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
+    /**
+     * POST /api/escalations/related/rows
+     * Body: { role, id, set, version?, limit? }
+     */
+    router.post('/related/rows', async (req, res) => {
+        const result = await api.getRelatedRows(req.body ?? {}, req.auth);
+        res.status(result.status).json(result.data ?? { error: result.error });
+    });
+}

package/build/routes/escalations/resolve.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerResolveRoutes(router: Router): void;

package/build/routes/escalations/single.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerSingleRoutes(router: Router): void;

package/build/routes/escalations/single.js

@@ -53,7 +53,7 @@ function registerSingleRoutes(router) {
     router.get('/by-workflow/:workflowId', async (req, res) => {
         const result = await api.getEscalationsByWorkflowId({
             workflowId: req.params.workflowId,
-        });
+        }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
     // -- Parameterized routes (must come after literal paths) --

package/build/routes/exports.js

@@ -33,14 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/exports"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/workflow-states/jobs
  * List workflow jobs with optional filtering and pagination.
  */
-router.get('/jobs', async (req, res) => {
+router.get('/jobs', auth_1.requireBuilder, async (req, res) => {
     const app_id = (req.query.app_id || req.query.namespace);
     if (!app_id) {
         res.status(400).json({ error: 'app_id (or namespace) query parameter is required' });
@@ -63,7 +64,7 @@ router.get('/jobs', async (req, res) => {
  * GET /api/workflow-states/:workflowId
  * Export the full workflow state using HotMesh's durable export.
  */
-router.get('/:workflowId', async (req, res) => {
+router.get('/:workflowId', auth_1.requireBuilder, async (req, res) => {
     const allow = req.query.allow
         ? req.query.allow.split(',')
         : undefined;
@@ -72,7 +73,7 @@ router.get('/:workflowId', async (req, res) => {
         : undefined;
     const values = req.query.values === 'false' ? false : undefined;
     const result = await api.exportWorkflowState({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         allow,
         block,
         values,
@@ -83,9 +84,9 @@ router.get('/:workflowId', async (req, res) => {
  * GET /api/workflow-states/:workflowId/execution
  * Export workflow state as a structured execution event history.
  */
-router.get('/:workflowId/execution', async (req, res) => {
+router.get('/:workflowId/execution', auth_1.requireWorkflowReader, async (req, res) => {
     const result = await api.exportWorkflowExecution({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         excludeSystem: req.query.excludeSystem === 'true',
         omitResults: req.query.omitResults === 'true',
         mode: req.query.mode || undefined,
@@ -100,9 +101,9 @@ router.get('/:workflowId/execution', async (req, res) => {
  * The workflow's input and output envelopes — two narrow lookups, no event
  * stream. Output is null with status 'running' until the workflow completes.
  */
-router.get('/:workflowId/envelopes', async (req, res) => {
+router.get('/:workflowId/envelopes', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowEnvelopes({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -110,9 +111,9 @@ router.get('/:workflowId/envelopes', async (req, res) => {
  * GET /api/workflow-states/:workflowId/status
  * Return only the numeric status semaphore.
  */
-router.get('/:workflowId/status', async (req, res) => {
+router.get('/:workflowId/status', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowStatus({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -120,9 +121,9 @@ router.get('/:workflowId/status', async (req, res) => {
  * GET /api/workflow-states/:workflowId/state
  * Return the current job state of the workflow.
  */
-router.get('/:workflowId/state', async (req, res) => {
+router.get('/:workflowId/state', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowState({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });

package/build/routes/file-browser.js

@@ -36,18 +36,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const path_1 = __importDefault(require("path"));
 const api = __importStar(require("../api/files"));
 const storage_1 = require("../lib/storage");
 const mime_1 = require("../lib/storage/mime");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/file-browser/browse
  * List files and directories at a given prefix.
  * Query: ?prefix=screenshots/&pageSize=100&continuationToken=...
  */
-router.get('/browse', async (req, res) => {
+router.get('/browse', auth_1.requireBuilder, async (req, res) => {
     const result = await api.browseFiles({
         prefix: req.query.prefix,
         pageSize: req.query.pageSize ? parseInt(req.query.pageSize, 10) : undefined,
@@ -59,7 +60,7 @@ router.get('/browse', async (req, res) => {
  * GET /api/file-browser/metadata/*
  * Get metadata for a single file.
  */
-router.get('/metadata/{*filePath}', async (req, res) => {
+router.get('/metadata/{*filePath}', auth_1.requireBuilder, async (req, res) => {
     const raw = req.params.filePath;
     const filePath = Array.isArray(raw) ? raw.join('/') : raw;
     if (!filePath) {
@@ -74,7 +75,7 @@ router.get('/metadata/{*filePath}', async (req, res) => {
  * Generate a time-limited signed URL for sharing.
  * Body: { path, expiresIn } — expiresIn in seconds (3600, 21600, 86400, 604800, 2592000)
  */
-router.post('/signed-url', async (req, res) => {
+router.post('/signed-url', auth_1.requireBuilder, async (req, res) => {
     const { path: filePath, expiresIn } = req.body;
     if (!filePath || !expiresIn) {
         res.status(400).json({ error: 'path and expiresIn are required' });
@@ -90,7 +91,7 @@ router.post('/signed-url', async (req, res) => {
  * DELETE /api/file-browser/delete/*
  * Permanently delete a file.
  */
-router.delete('/delete/{*filePath}', async (req, res) => {
+router.delete('/delete/{*filePath}', auth_1.requireBuilder, async (req, res) => {
     const raw = req.params.filePath;
     const filePath = Array.isArray(raw) ? raw.join('/') : raw;
     if (!filePath) {
@@ -104,7 +105,7 @@ router.delete('/delete/{*filePath}', async (req, res) => {
  * GET /api/file-browser/download/*
  * Download a file with Content-Disposition: attachment.
  */
-router.get('/download/{*filePath}', async (req, res) => {
+router.get('/download/{*filePath}', auth_1.requireBuilder, async (req, res) => {
     const raw = req.params.filePath;
     const filePath = Array.isArray(raw) ? raw.join('/') : raw;
     if (!filePath) {
@@ -129,7 +130,7 @@ router.get('/download/{*filePath}', async (req, res) => {
  * Query: ?path=images/photo.png (target path including filename)
  * Body: raw file bytes (Content-Type should match the file type)
  */
-router.post('/upload', async (req, res) => {
+router.post('/upload', auth_1.requireBuilder, async (req, res) => {
     const targetPath = req.query.path;
     if (!targetPath) {
         res.status(400).json({ error: 'path query parameter required (e.g., ?path=images/photo.png)' });

package/build/routes/files.js

@@ -3,11 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const storage_1 = require("../lib/storage");
 const mime_1 = require("../lib/storage/mime");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/files/*
  * Serve files from managed file storage.

package/build/routes/index.js

@@ -3,11 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const auth_2 = __importDefault(require("./auth"));
 const auth_sso_1 = __importDefault(require("./auth-sso"));
 const oauth_1 = __importDefault(require("./oauth"));
+const oauth_server_1 = __importDefault(require("./oauth-server"));
 const delegation_1 = __importDefault(require("./delegation"));
 const tasks_1 = __importDefault(require("./tasks"));
 const escalations_1 = __importDefault(require("./escalations"));
@@ -39,11 +40,12 @@ const nats_credentials_1 = __importDefault(require("./nats-credentials"));
 const scan_codes_1 = __importDefault(require("./scan-codes"));
 const domain_1 = __importDefault(require("./domain"));
 const announcements_1 = __importDefault(require("./announcements"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Public routes (no auth required — they handle their own auth)
 router.use('/auth', auth_2.default);
 router.use('/auth', auth_sso_1.default);
 router.use('/auth/oauth', oauth_1.default);
+router.use('/oauth', oauth_server_1.default);
 router.use('/delegation', delegation_1.default);
 router.use('/files', files_1.default);
 router.use('/settings', settings_1.default);

package/build/routes/insight.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/insight"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/insight/mcp-query
  * Run a general-purpose MCP query using all available tools.
@@ -52,7 +53,7 @@ router.post('/mcp-query', async (req, res) => {
  * The LLM reasons about tool schemas and constructs the YAML declaratively.
  * Body: { prompt: string, tags?: string[], wait?: boolean, feedback?: string, prior_yaml?: string }
  */
-router.post('/build-workflow', async (req, res) => {
+router.post('/build-workflow', auth_1.requireBuilder, async (req, res) => {
     const { prompt, tags, wait, feedback, prior_yaml, answers, prior_questions } = req.body;
     const result = await api.buildWorkflow({ prompt, tags, wait, feedback, prior_yaml, answers, prior_questions }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -62,7 +63,7 @@ router.post('/build-workflow', async (req, res) => {
  * Refine a previously built workflow using execution feedback.
  * Body: { prompt: string, prior_yaml: string, feedback: string, tags?: string[], wait?: boolean }
  */
-router.post('/build-workflow/refine', async (req, res) => {
+router.post('/build-workflow/refine', auth_1.requireBuilder, async (req, res) => {
     const { prompt, prior_yaml, feedback, tags, wait } = req.body;
     const result = await api.refineWorkflow({ prompt, prior_yaml, feedback, tags, wait }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });

package/build/routes/knowledge.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/knowledge"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // The knowledge store is a builder surface (superadmin or engineer) — the
 // same gate as the dashboard's Knowledge page. Members reach knowledge
 // content only through escalation lookup refs: an escalation's

package/build/routes/maintenance.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/maintenance"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/config/maintenance
  * Return the current maintenance configuration.

package/build/routes/mcp-endpoint.d.ts

@@ -6,7 +6,9 @@
  * streamable-http transport protocol.
  *
  * Stateless mode — each POST creates a fresh server+transport pair.
- * Auth via Bearer token (JWT or bot API key) in the Authorization header.
+ * Auth via Bearer token (JWT, bot API key, or OAuth access token) in the
+ * Authorization header.
+ * The caller sees only the tools whose manifest gate they hold.
  *
  * Mount at /mcp:
  *   POST /mcp  → JSON-RPC messages (initialize, tools/list, tools/call)