@hotmeshio/long-tail 0.23.2 → 0.24.0

package/build/modules/capabilities.js

@@ -0,0 +1,188 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mayAdminister = mayAdminister;
+exports.mayBuild = mayBuild;
+exports.mayReadWorkflowRun = mayReadWorkflowRun;
+exports.mayManageRoles = mayManageRoles;
+exports.mayGrantRole = mayGrantRole;
+exports.mayGrantRoles = mayGrantRoles;
+exports.mayManageAccount = mayManageAccount;
+exports.mayRevokeRole = mayRevokeRole;
+exports.resolveCapabilities = resolveCapabilities;
+exports.capabilityAccess = capabilityAccess;
+const user_1 = require("../services/user");
+const export_1 = require("../services/export");
+const uuid_1 = require("../lib/uuid");
+const BUILDER_ROLE = 'engineer';
+async function hasBuilderRole(userId) {
+    const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
+    return hasRole(userId, BUILDER_ROLE);
+}
+/** Admin or superadmin claim, or a superadmin in the database. */
+async function mayAdminister(principal) {
+    if (!principal?.userId)
+        return false;
+    if (principal.role === 'admin' || principal.role === 'superadmin')
+        return true;
+    return (0, user_1.isSuperAdmin)(principal.userId);
+}
+/** Superadmin (claim or database), or holder of the engineer role. */
+async function mayBuild(principal) {
+    if (!principal?.userId)
+        return false;
+    if (principal.role === 'superadmin')
+        return true;
+    if (await (0, user_1.isSuperAdmin)(principal.userId))
+        return true;
+    return hasBuilderRole(principal.userId);
+}
+/**
+ * Builder access, or the person a workflow run was started by or runs as,
+ * read from the run's own start envelope.
+ */
+async function mayReadWorkflowRun(principal, workflowId) {
+    if (!principal?.userId)
+        return false;
+    if (await mayBuild(principal))
+        return true;
+    const started = await (0, export_1.getWorkflowStartIdentity)(workflowId);
+    return !!started && (started.userId === principal.userId || started.initiatedBy === principal.userId);
+}
+/** Anyone who may administer, plus holders of the engineer role. */
+async function mayManageRoles(principal) {
+    if (!principal?.userId)
+        return false;
+    if (await mayAdminister(principal))
+        return true;
+    return hasBuilderRole(principal.userId);
+}
+/**
+ * Whether `granterId` may assign `grant` to a user.
+ *
+ * - superadmin: any role and type
+ * - engineer: any role, never the superadmin type
+ * - anyone else: only roles they hold, never the superadmin type
+ */
+async function mayGrantRole(granterId, grant) {
+    if (await (0, user_1.isSuperAdmin)(granterId))
+        return { allowed: true };
+    if (grant.type === 'superadmin') {
+        return { allowed: false, error: 'Only superadmin can assign superadmin role type' };
+    }
+    if (await hasBuilderRole(granterId))
+        return { allowed: true };
+    const { hasRole } = await Promise.resolve().then(() => __importStar(require('../services/user/roles')));
+    if (await hasRole(granterId, grant.role))
+        return { allowed: true };
+    return { allowed: false, error: `You can only assign roles you hold. You do not have the '${grant.role}' role.` };
+}
+const ALLOWED = { allowed: true };
+/** Whether `granterId` may assign every grant in a new account's role list. */
+async function mayGrantRoles(granterId, grants) {
+    for (const grant of grants ?? []) {
+        const decision = await mayGrantRole(granterId, grant);
+        if (!decision.allowed)
+            return decision;
+    }
+    return ALLOWED;
+}
+/**
+ * Whether `callerId` may change, remove, or mint keys for an account. An
+ * account holding superadmin is a superadmin's to manage; any other account
+ * is left to the route's own gate.
+ */
+async function mayManageAccount(callerId, targetId) {
+    if (await (0, user_1.isSuperAdmin)(callerId))
+        return ALLOWED;
+    if (!(0, uuid_1.isUuid)(targetId))
+        return ALLOWED;
+    if (await (0, user_1.isSuperAdmin)(targetId)) {
+        return { allowed: false, error: 'Only superadmin can change a superadmin account' };
+    }
+    return ALLOWED;
+}
+/** Removing a role follows the grant rule for the role as the account holds it. */
+async function mayRevokeRole(callerId, targetId, role) {
+    const account = await mayManageAccount(callerId, targetId);
+    if (!account.allowed || !(0, uuid_1.isUuid)(targetId))
+        return account;
+    const { getUserRoles } = await Promise.resolve().then(() => __importStar(require('../services/user')));
+    const held = (await getUserRoles(targetId)).find((r) => r.role === role);
+    return held ? mayGrantRole(callerId, { role, type: held.type }) : ALLOWED;
+}
+/** Capabilities from memberships carried by the caller's token: the same outcomes, no lookup. */
+function capabilitiesFromRoles(roles) {
+    const superadmin = roles.some((r) => r.type === 'superadmin');
+    const admin = superadmin || roles.some((r) => r.type === 'admin');
+    const engineer = roles.some((r) => r.role === BUILDER_ROLE);
+    return { caller: true, admin, builder: superadmin || engineer, roleManager: admin || engineer, superadmin };
+}
+const NO_CAPABILITIES = {
+    caller: false, admin: false, builder: false, roleManager: false, superadmin: false,
+};
+/**
+ * Every capability the principal holds, with the same outcomes as the
+ * predicates above. A superadmin claim costs no lookup; anyone else costs
+ * at most one superadmin lookup and one engineer-role lookup.
+ */
+async function resolveCapabilities(principal) {
+    if (!principal?.userId)
+        return NO_CAPABILITIES;
+    if (principal.grantRoles)
+        return capabilitiesFromRoles(principal.grantRoles);
+    if (principal.role === 'superadmin' || (await (0, user_1.isSuperAdmin)(principal.userId))) {
+        return { caller: true, admin: true, builder: true, roleManager: true, superadmin: true };
+    }
+    const admin = principal.role === 'admin';
+    const engineer = await hasBuilderRole(principal.userId);
+    return { caller: true, admin, builder: engineer, roleManager: admin || engineer, superadmin: false };
+}
+/**
+ * Capability checks for one request. `caller` needs only an authenticated
+ * principal; any other gate resolves the principal's capabilities once, on
+ * first need, so a request that checks only `caller` gates makes no lookup.
+ */
+function capabilityAccess(principal) {
+    let resolved;
+    return async (gate) => {
+        if (!principal?.userId)
+            return false;
+        if (gate === 'caller')
+            return true;
+        resolved ??= resolveCapabilities(principal);
+        return (await resolved)[gate];
+    };
+}

package/build/modules/config.d.ts

@@ -8,9 +8,23 @@ export declare const config: {
     NATS_URL: string;
     NATS_WS_URL: string;
     NATS_TOKEN: string;
+    /** A subscribe-only NATS credential for browsers that connect without the proxy. */
+    NATS_DASHBOARD_TOKEN: string;
+    /** How long a browser's WebSocket proxy ticket admits an upgrade. The dashboard fetches one per attempt. */
+    NATS_WS_TICKET_TTL_SECONDS: number;
+    /**
+     * Dashboard reconnect: first backoff delay, delay cap, how long a drop lasts
+     * before the banner shows, and the window the first retry and catch-up
+     * refetch spread across.
+     */
+    NATS_RECONNECT_INITIAL_MS: number;
+    NATS_RECONNECT_MAX_MS: number;
+    NATS_LIVE_NOTICE_AFTER_MS: number;
+    NATS_RECONNECT_SPREAD_MS: number;
     PORT: number;
     NODE_ENV: string;
     JWT_SECRET: string;
+    LT_OAUTH_ISSUER: string;
     HONEYCOMB_API_KEY: string;
     ROLE_ENFORCEMENT_CACHE_TTL_MS: number;
     LT_ANALYTICS_MAX_GROUPS: number;

package/build/modules/config.js

@@ -1,6 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.postgres_options = exports.config = void 0;
+/** A positive integer from the environment, or the default when unset or malformed. */
+function positiveInt(name, fallback) {
+    const value = Number(process.env[name]);
+    return Number.isInteger(value) && value > 0 ? value : fallback;
+}
 exports.config = {
     POSTGRES_HOST: process.env.POSTGRES_HOST || 'localhost',
     POSTGRES_PORT: parseInt(process.env.POSTGRES_PORT || '5415', 10),
@@ -15,9 +20,24 @@ exports.config = {
     NATS_URL: process.env.NATS_URL || 'nats://localhost:4222',
     NATS_WS_URL: process.env.NATS_WS_URL || '',
     NATS_TOKEN: process.env.NATS_TOKEN || '',
+    /** A subscribe-only NATS credential for browsers that connect without the proxy. */
+    NATS_DASHBOARD_TOKEN: process.env.NATS_DASHBOARD_TOKEN || '',
+    /** How long a browser's WebSocket proxy ticket admits an upgrade. The dashboard fetches one per attempt. */
+    NATS_WS_TICKET_TTL_SECONDS: positiveInt('NATS_WS_TICKET_TTL_SECONDS', 300),
+    /**
+     * Dashboard reconnect: first backoff delay, delay cap, how long a drop lasts
+     * before the banner shows, and the window the first retry and catch-up
+     * refetch spread across.
+     */
+    NATS_RECONNECT_INITIAL_MS: positiveInt('NATS_RECONNECT_INITIAL_MS', 1000),
+    NATS_RECONNECT_MAX_MS: positiveInt('NATS_RECONNECT_MAX_MS', 60000),
+    NATS_LIVE_NOTICE_AFTER_MS: positiveInt('NATS_LIVE_NOTICE_AFTER_MS', 30000),
+    NATS_RECONNECT_SPREAD_MS: positiveInt('NATS_RECONNECT_SPREAD_MS', 5000),
     PORT: parseInt(process.env.PORT || '3000', 10),
     NODE_ENV: process.env.NODE_ENV || 'development',
     JWT_SECRET: process.env.JWT_SECRET || '',
+    // Enables the OAuth authorization server for /mcp when start() passes no auth.oauthServer.
+    LT_OAUTH_ISSUER: process.env.LT_OAUTH_ISSUER || '',
     HONEYCOMB_API_KEY: process.env.HONEYCOMB_API_KEY || '',
     // Resolver schema enforcement: TTL for the cached enforcing-role set and
     // latest role form schemas. Bounds cross-container staleness after a role

package/build/modules/defaults.d.ts

@@ -60,3 +60,13 @@ export declare const CLAIM_DURATION_OPTIONS: number[];
 export declare const STOP_WORDS: Set<string>;
 /** YAML dump line width. */
 export declare const YAML_LINE_WIDTH: number;
+/** Access-token lifetime. Bounds how stale a token's roles can be when no revocation event arrives. */
+export declare const OAUTH_ACCESS_TOKEN_TTL_SECONDS: number;
+/** Refresh-token lifetime. Each refresh issues a new one. */
+export declare const OAUTH_REFRESH_TOKEN_TTL_SECONDS: number;
+/** Authorization-code lifetime, from consent to the client's token request. */
+export declare const OAUTH_CODE_TTL_SECONDS: number;
+/** Client registrations allowed per address in each window. */
+export declare const OAUTH_REGISTRATIONS_PER_WINDOW: number;
+/** Registration rate-limit window. */
+export declare const OAUTH_REGISTRATION_WINDOW_SECONDS: number;

package/build/modules/defaults.js

@@ -9,7 +9,7 @@
  * Grouped by domain so related knobs live together.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.YAML_LINE_WIDTH = exports.STOP_WORDS = exports.CLAIM_DURATION_OPTIONS = exports.ESCALATION_BULK_RESOLVE_MAX = exports.YAML_VERSION_LIMIT = exports.YAML_LIST_LIMIT = exports.QUERY_LIMIT_MAX = exports.QUERY_LIMIT_DEFAULT = exports.CONFIG_CACHE_TTL_MS = exports.MCP_TOOL_TIMEOUT_MS = exports.WORKFLOW_SYNC_TIMEOUT_MS = exports.JOB_EXPIRE_SECS = exports.WORKFLOW_EXPIRE_SECS = exports.TOOL_ARG_LIMIT_CAP = exports.TOOL_ROUNDS_MCP_QUERY = exports.TOOL_ROUNDS_TRIAGE = exports.TOOL_RESULT_MAX_CHARS = exports.LLM_MAX_INPUT_CHARS = exports.LLM_MAX_ARRAY_ITEMS = exports.LLM_MAX_TOKENS_VISION = exports.LLM_MAX_TOKENS_JSON = exports.LLM_MAX_TOKENS_DEFAULT = exports.LLM_BASE_URL = exports.LLM_MODEL_SECONDARY = exports.LLM_MODEL_PRIMARY = void 0;
+exports.OAUTH_REGISTRATION_WINDOW_SECONDS = exports.OAUTH_REGISTRATIONS_PER_WINDOW = exports.OAUTH_CODE_TTL_SECONDS = exports.OAUTH_REFRESH_TOKEN_TTL_SECONDS = exports.OAUTH_ACCESS_TOKEN_TTL_SECONDS = exports.YAML_LINE_WIDTH = exports.STOP_WORDS = exports.CLAIM_DURATION_OPTIONS = exports.ESCALATION_BULK_RESOLVE_MAX = exports.YAML_VERSION_LIMIT = exports.YAML_LIST_LIMIT = exports.QUERY_LIMIT_MAX = exports.QUERY_LIMIT_DEFAULT = exports.CONFIG_CACHE_TTL_MS = exports.MCP_TOOL_TIMEOUT_MS = exports.WORKFLOW_SYNC_TIMEOUT_MS = exports.JOB_EXPIRE_SECS = exports.WORKFLOW_EXPIRE_SECS = exports.TOOL_ARG_LIMIT_CAP = exports.TOOL_ROUNDS_MCP_QUERY = exports.TOOL_ROUNDS_TRIAGE = exports.TOOL_RESULT_MAX_CHARS = exports.LLM_MAX_INPUT_CHARS = exports.LLM_MAX_ARRAY_ITEMS = exports.LLM_MAX_TOKENS_VISION = exports.LLM_MAX_TOKENS_JSON = exports.LLM_MAX_TOKENS_DEFAULT = exports.LLM_BASE_URL = exports.LLM_MODEL_SECONDARY = exports.LLM_MODEL_PRIMARY = void 0;
 function envInt(key, fallback) {
     const v = process.env[key];
     if (v === undefined || v === '')
@@ -97,3 +97,14 @@ exports.STOP_WORDS = new Set([
 // ── Formatting ───────────────────────────────────────────────────────
 /** YAML dump line width. */
 exports.YAML_LINE_WIDTH = envInt('LT_YAML_LINE_WIDTH', 120);
+// ── OAuth authorization server ───────────────────────────────────────
+/** Access-token lifetime. Bounds how stale a token's roles can be when no revocation event arrives. */
+exports.OAUTH_ACCESS_TOKEN_TTL_SECONDS = envInt('LT_OAUTH_ACCESS_TOKEN_TTL_SECONDS', 300);
+/** Refresh-token lifetime. Each refresh issues a new one. */
+exports.OAUTH_REFRESH_TOKEN_TTL_SECONDS = envInt('LT_OAUTH_REFRESH_TOKEN_TTL_SECONDS', 30 * 24 * 60 * 60);
+/** Authorization-code lifetime, from consent to the client's token request. */
+exports.OAUTH_CODE_TTL_SECONDS = envInt('LT_OAUTH_CODE_TTL_SECONDS', 60);
+/** Client registrations allowed per address in each window. */
+exports.OAUTH_REGISTRATIONS_PER_WINDOW = envInt('LT_OAUTH_REGISTRATIONS_PER_WINDOW', 20);
+/** Registration rate-limit window. */
+exports.OAUTH_REGISTRATION_WINDOW_SECONDS = envInt('LT_OAUTH_REGISTRATION_WINDOW_SECONDS', 600);

package/build/modules/mcp-auth.d.ts

@@ -0,0 +1,11 @@
+import type { RequestHandler } from '../lib/http';
+/**
+ * Authentication for `/mcp`. Only a credential the request carries itself
+ * authenticates: the host's SSO cookie fallback never applies here, since a
+ * cookie rides along on a request any page the person visits can send. With
+ * the OAuth server configured, an access token for this resource
+ * authenticates the request while its grant is live, and every 401 carries
+ * the RFC 9728 challenge so MCP clients can discover how to sign in. Any other
+ * credential goes through the configured auth adapter unchanged.
+ */
+export declare const requireMcpAuth: RequestHandler;

package/build/modules/mcp-auth.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireMcpAuth = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const auth_1 = require("./auth");
+const oauth_server_1 = require("./oauth-server");
+const oauth_server_2 = require("../services/auth/oauth-server");
+const CHALLENGE_HEADER = 'WWW-Authenticate';
+function bearerToken(req) {
+    const header = req.headers.authorization;
+    return header?.startsWith('Bearer ') ? header.slice(7) : null;
+}
+function isAccessToken(token) {
+    const decoded = jsonwebtoken_1.default.decode(token, { complete: true });
+    return decoded?.header?.typ === oauth_server_2.ACCESS_TOKEN_TYPE;
+}
+function challenge(settings, error) {
+    const base = `Bearer resource_metadata="${settings.resourceMetadataUrl}"`;
+    return error ? `${base}, error="${error}"` : base;
+}
+/**
+ * Authentication for `/mcp`. Only a credential the request carries itself
+ * authenticates: the host's SSO cookie fallback never applies here, since a
+ * cookie rides along on a request any page the person visits can send. With
+ * the OAuth server configured, an access token for this resource
+ * authenticates the request while its grant is live, and every 401 carries
+ * the RFC 9728 challenge so MCP clients can discover how to sign in. Any other
+ * credential goes through the configured auth adapter unchanged.
+ */
+const requireMcpAuth = async (req, res, next) => {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    if (!settings)
+        return (0, auth_1.requireCredentialAuth)(req, res, next);
+    const token = bearerToken(req);
+    if (token && isAccessToken(token)) {
+        const claims = (0, oauth_server_2.verifyAccessToken)(token, { issuer: settings.issuer, audience: settings.resource });
+        const live = claims ? await (0, oauth_server_2.getLiveGrant)(claims.gid, claims.sub) : null;
+        if (!claims || !live || live.client_id !== claims.client_id) {
+            res.setHeader(CHALLENGE_HEADER, challenge(settings, 'invalid_token'));
+            res.status(401).json({ error: 'invalid_token' });
+            return;
+        }
+        req.auth = (0, oauth_server_2.accessTokenPrincipal)(claims, live);
+        next();
+        return;
+    }
+    res.setHeader(CHALLENGE_HEADER, challenge(settings));
+    return (0, auth_1.requireCredentialAuth)(req, res, (err) => {
+        res.removeHeader(CHALLENGE_HEADER);
+        next(err);
+    });
+};
+exports.requireMcpAuth = requireMcpAuth;

package/build/modules/oauth-server.d.ts

@@ -0,0 +1,18 @@
+import type { LTOAuthServerConfig } from '../types/oauth-server';
+/** The configured authorization server, with the URLs derived from its issuer. */
+export interface OAuthServerSettings {
+    issuer: string;
+    /** The protected resource, and the audience of its access tokens. */
+    resource: string;
+    /** RFC 9728 protected-resource metadata URL for `resource`. */
+    resourceMetadataUrl: string;
+    /** Canonical https redirect URIs allowed beyond loopback. */
+    allowedRedirectUris: string[];
+}
+/** An https URI in canonical form, or null when it is not one (a malformed entry never matches). */
+export declare function canonicalHttpsUri(uri: string): string | null;
+export declare function setOAuthServerConfig(config: LTOAuthServerConfig): void;
+/** Read per request: routers may be mounted before start() configures the server. */
+export declare function getOAuthServerSettings(): OAuthServerSettings | null;
+/** Reset. Used by tests. */
+export declare function clearOAuthServerConfig(): void;

package/build/modules/oauth-server.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalHttpsUri = canonicalHttpsUri;
+exports.setOAuthServerConfig = setOAuthServerConfig;
+exports.getOAuthServerSettings = getOAuthServerSettings;
+exports.clearOAuthServerConfig = clearOAuthServerConfig;
+/** An https URI in canonical form, or null when it is not one (a malformed entry never matches). */
+function canonicalHttpsUri(uri) {
+    try {
+        const url = new URL(uri);
+        if (url.protocol !== 'https:' || url.username || url.password || url.hash)
+            return null;
+        return url.href;
+    }
+    catch {
+        return null;
+    }
+}
+let settings = null;
+function setOAuthServerConfig(config) {
+    const issuer = config.issuer.replace(/\/+$/, '');
+    const resource = `${issuer}/mcp`;
+    const url = new URL(resource);
+    settings = {
+        issuer,
+        resource,
+        resourceMetadataUrl: `${url.origin}/.well-known/oauth-protected-resource${url.pathname}`,
+        allowedRedirectUris: (config.allowedRedirectUris ?? [])
+            .map(canonicalHttpsUri)
+            .filter((uri) => uri !== null),
+    };
+}
+/** Read per request: routers may be mounted before start() configures the server. */
+function getOAuthServerSettings() {
+    return settings;
+}
+/** Reset. Used by tests. */
+function clearOAuthServerConfig() {
+    settings = null;
+}

package/build/routes/agents.js

@@ -33,10 +33,26 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/agents"));
 const subApi = __importStar(require("../api/agent-subscriptions"));
-const router = (0, express_1.Router)();
+const auth_1 = require("../modules/auth");
+const authority_1 = require("../services/agent/authority");
+const workflow_invocation_1 = require("../services/workflow-invocation");
+const router = (0, http_1.Router)();
+/** Run an authority check; answer its refusal and return false when it refuses. */
+async function authorized(check, res) {
+    try {
+        await check();
+        return true;
+    }
+    catch (err) {
+        if (!(err instanceof workflow_invocation_1.InvocationError))
+            throw err;
+        res.status(err.statusCode).json({ error: err.message });
+        return false;
+    }
+}
 /**
  * GET /api/agents
  * List agents with optional filters.
@@ -63,12 +79,14 @@ router.get('/:id', async (req, res) => {
  * POST /api/agents
  * Create a new agent.
  */
-router.post('/', async (req, res) => {
+router.post('/', auth_1.requireBuilder, async (req, res) => {
     const { id } = req.body;
     if (!id) {
         res.status(400).json({ error: 'id is required (kebab-case agent name, e.g. "content-triage")' });
         return;
     }
+    if (!(await authorized(() => (0, authority_1.assertMayConfigureAgent)(req.auth.userId, { ...req.body, id: undefined }), res)))
+        return;
     const auth = { userId: req.userId, roles: req.roles };
     const result = await api.createAgent(req.body, auth);
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -77,16 +95,19 @@ router.post('/', async (req, res) => {
  * PUT /api/agents/:id
  * Update an existing agent.
  */
-router.put('/:id', async (req, res) => {
-    const result = await api.updateAgent({ id: req.params.id, ...req.body });
+router.put('/:id', auth_1.requireBuilder, async (req, res) => {
+    const id = String(req.params.id);
+    if (!(await authorized(() => (0, authority_1.assertMayConfigureAgent)(req.auth.userId, { ...req.body, id }), res)))
+        return;
+    const result = await api.updateAgent({ ...req.body, id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * DELETE /api/agents/:id
  * Delete an agent.
  */
-router.delete('/:id', async (req, res) => {
-    const result = await api.deleteAgent({ id: req.params.id });
+router.delete('/:id', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deleteAgent({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 // ── Subscription routes (nested under agent) ─────────────────────────────────
@@ -102,29 +123,40 @@ router.get('/:agentId/subscriptions', async (req, res) => {
  * POST /api/agents/:agentId/subscriptions
  * Create an event subscription for an agent.
  */
-router.post('/:agentId/subscriptions', async (req, res) => {
-    const { topic, reaction_type } = req.body;
+router.post('/:agentId/subscriptions', auth_1.requireBuilder, async (req, res) => {
+    const { topic, reaction_type, execute_as } = req.body;
     if (!topic || !reaction_type) {
         res.status(400).json({ error: 'topic and reaction_type are required' });
         return;
     }
-    const result = await subApi.createSubscription({ agentId: req.params.agentId, ...req.body });
+    const agentId = String(req.params.agentId);
+    const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, { agentId, reaction_type, execute_as });
+    if (!(await authorized(check, res)))
+        return;
+    const result = await subApi.createSubscription({ ...req.body, agentId });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * PUT /api/agents/:agentId/subscriptions/:subId
  * Update an event subscription.
  */
-router.put('/:agentId/subscriptions/:subId', async (req, res) => {
-    const result = await subApi.updateSubscription({ id: req.params.subId, ...req.body });
+router.put('/:agentId/subscriptions/:subId', auth_1.requireBuilder, async (req, res) => {
+    const agentId = String(req.params.agentId);
+    const id = String(req.params.subId);
+    const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, {
+        agentId, subscriptionId: id, reaction_type: req.body?.reaction_type, execute_as: req.body?.execute_as,
+    });
+    if (!(await authorized(check, res)))
+        return;
+    const result = await subApi.updateSubscription({ ...req.body, id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * DELETE /api/agents/:agentId/subscriptions/:subId
  * Delete an event subscription.
  */
-router.delete('/:agentId/subscriptions/:subId', async (req, res) => {
-    const result = await subApi.deleteSubscription({ id: req.params.subId });
+router.delete('/:agentId/subscriptions/:subId', auth_1.requireBuilder, async (req, res) => {
+    const result = await subApi.deleteSubscription({ id: String(req.params.subId) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/announcements.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/announcements"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * Dashboard announcements. Publishing and removal are role-manager acts
  * (superadmin, admin type, or engineer); any authenticated user reads their

package/build/routes/auth-sso.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/auth-sso"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/auth/sso
  * Exchange host authentication for a Long Tail JWT.

package/build/routes/auth.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/auth"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/auth/login
  * Authenticate with username (external_id) and password.

package/build/routes/bot-accounts.js

@@ -33,10 +33,18 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
+const capabilities_1 = require("../modules/capabilities");
 const api = __importStar(require("../api/bot-accounts"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
+/** Answer a refused decision with 403; true when the request may go on. */
+function allowed(decision, res) {
+    if (decision.allowed)
+        return true;
+    res.status(403).json({ error: decision.error });
+    return false;
+}
 // All bot account routes require admin access
 router.use(auth_1.requireBuilder);
 // ── Bot CRUD ─────────────────────────────────────────────────────────────────
@@ -69,6 +77,8 @@ router.get('/:id', async (req, res) => {
  */
 router.post('/', async (req, res) => {
     const { name, description, display_name, roles } = req.body || {};
+    if (!allowed(await (0, capabilities_1.mayGrantRoles)(req.auth.userId, roles), res))
+        return;
     const result = await api.createBot({ name, description, display_name, roles }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -78,6 +88,8 @@ router.post('/', async (req, res) => {
  * Body: { display_name?, description?, status? }
  */
 router.put('/:id', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.updateBot({ id: req.params.id, ...(req.body || {}) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -86,6 +98,8 @@ router.put('/:id', async (req, res) => {
  * Delete a bot account.
  */
 router.delete('/:id', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.deleteBot({ id: req.params.id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -105,6 +119,8 @@ router.get('/:id/roles', async (req, res) => {
  */
 router.post('/:id/roles', async (req, res) => {
     const { role, type } = req.body || {};
+    if (!allowed(await (0, capabilities_1.mayGrantRole)(req.auth.userId, { role, type }), res))
+        return;
     const result = await api.addBotRole({ id: req.params.id, role, type });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -113,6 +129,8 @@ router.post('/:id/roles', async (req, res) => {
  * Remove a role from a bot.
  */
 router.delete('/:id/roles/:role', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayRevokeRole)(req.auth.userId, String(req.params.id), String(req.params.role)), res))
+        return;
     const result = await api.removeBotRole({ id: req.params.id, role: req.params.role });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -132,6 +150,8 @@ router.get('/:id/api-keys', async (req, res) => {
  * Returns the raw key ONCE — it cannot be retrieved again.
  */
 router.post('/:id/api-keys', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const { name, scopes, expires_at } = req.body || {};
     const result = await api.createBotKey({
         id: req.params.id,
@@ -146,7 +166,10 @@ router.post('/:id/api-keys', async (req, res) => {
  * Revoke (delete) a bot API key.
  */
 router.delete('/:id/api-keys/:keyId', async (req, res) => {
-    const result = await api.revokeBotKey({ keyId: req.params.keyId });
+    const botId = String(req.params.id);
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, botId), res))
+        return;
+    const result = await api.revokeBotKey({ keyId: String(req.params.keyId), botId });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;