@hotmeshio/long-tail 0.23.2 → 0.24.0

package/build/routes/capabilities.js

@@ -33,15 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/capabilities"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/capabilities
  * List all platform capabilities grouped by category.
  */
-router.get('/', async (_req, res) => {
-    const result = await api.listCapabilities();
+router.get('/', async (req, res) => {
+    const result = await api.listCapabilities(req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/controlplane.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/controlplane"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/controlplane/apps
  * List available HotMesh application namespaces.

package/build/routes/dba.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/dba"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/dba/prune
  * Prune expired jobs, streams, and execution artifacts.

package/build/routes/delegation.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const delegation_1 = require("../services/auth/delegation");
 const service_token_1 = require("../services/auth/service-token");
 const oauth_1 = require("../services/oauth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/delegation/oauth/:provider/token
  *

package/build/routes/diagnostics.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/diagnostics"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 const VALID_SECTIONS = new Set(['events', 'streams']);
 /** Parse a comma-separated `include` query param into the recognized heavy sections. */
 function parseInclude(raw) {

package/build/routes/docs.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 function projectRoot() {
     const candidates = [
         path.join(__dirname, '..'),

package/build/routes/domain.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/domain"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/domain
  * The deployment's domain dictionary: `{ doc, version, updated_at }`, or

package/build/routes/escalations/accumulate.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Open-accumulator routes. The literal single-segment paths are registered
  * before the parameterized routes so /:id never shadows them; the /:id/*

package/build/routes/escalations/acting.d.ts

@@ -1,4 +1,4 @@
-import type { Request, Response } from 'express';
+import type { Request, Response } from '../../lib/http';
 import type { LTApiAuth } from '../../types/sdk';
 /** The header a shared station device rides its badge grant on. */
 export declare const ACTING_TOKEN_HEADER = "x-lt-acting-token";

package/build/routes/escalations/analytics.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Escalation analytics HTTP surface — grouped membership/dwell aggregates and
  * per-entity timelines over the interval time-series. Read-only; the api layer

package/build/routes/escalations/bulk.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerBulkRoutes(router: Router): void;

package/build/routes/escalations/facets.d.ts

@@ -1,4 +1,4 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 /**
  * Faceted-routing HTTP surface — pond search + batch claim. Each operation targets a
  * single pond `role` and is RBAC-scoped to it (the api layer enforces the gate). These

package/build/routes/escalations/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const list_1 = require("./list");
 const bulk_1 = require("./bulk");
 const metadata_1 = require("./metadata");
@@ -10,7 +10,7 @@ const resolve_1 = require("./resolve");
 const facets_1 = require("./facets");
 const analytics_1 = require("./analytics");
 const related_1 = require("./related");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Registration order matters: literal paths before parameterized /:id routes.
 // GET /, /available, /types, /stats
 (0, list_1.registerListRoutes)(router);

package/build/routes/escalations/list.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerListRoutes(router: Router): void;

package/build/routes/escalations/metadata.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Register metadata-based escalation lookup routes.
  * Must be registered BEFORE parameterized /:id routes.

package/build/routes/escalations/related.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Related sets for role list views. The role's stored list schema declares
  * the sets; the caller names the role, the page's host rows, and the schema

package/build/routes/escalations/resolve.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerResolveRoutes(router: Router): void;

package/build/routes/escalations/single.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerSingleRoutes(router: Router): void;

package/build/routes/escalations/single.js

@@ -53,7 +53,7 @@ function registerSingleRoutes(router) {
     router.get('/by-workflow/:workflowId', async (req, res) => {
         const result = await api.getEscalationsByWorkflowId({
             workflowId: req.params.workflowId,
-        });
+        }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
     // -- Parameterized routes (must come after literal paths) --

package/build/routes/exports.js

@@ -33,14 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/exports"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/workflow-states/jobs
  * List workflow jobs with optional filtering and pagination.
  */
-router.get('/jobs', async (req, res) => {
+router.get('/jobs', auth_1.requireBuilder, async (req, res) => {
     const app_id = (req.query.app_id || req.query.namespace);
     if (!app_id) {
         res.status(400).json({ error: 'app_id (or namespace) query parameter is required' });
@@ -63,7 +64,7 @@ router.get('/jobs', async (req, res) => {
  * GET /api/workflow-states/:workflowId
  * Export the full workflow state using HotMesh's durable export.
  */
-router.get('/:workflowId', async (req, res) => {
+router.get('/:workflowId', auth_1.requireBuilder, async (req, res) => {
     const allow = req.query.allow
         ? req.query.allow.split(',')
         : undefined;
@@ -72,7 +73,7 @@ router.get('/:workflowId', async (req, res) => {
         : undefined;
     const values = req.query.values === 'false' ? false : undefined;
     const result = await api.exportWorkflowState({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         allow,
         block,
         values,
@@ -83,9 +84,9 @@ router.get('/:workflowId', async (req, res) => {
  * GET /api/workflow-states/:workflowId/execution
  * Export workflow state as a structured execution event history.
  */
-router.get('/:workflowId/execution', async (req, res) => {
+router.get('/:workflowId/execution', auth_1.requireWorkflowReader, async (req, res) => {
     const result = await api.exportWorkflowExecution({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         excludeSystem: req.query.excludeSystem === 'true',
         omitResults: req.query.omitResults === 'true',
         mode: req.query.mode || undefined,
@@ -100,9 +101,9 @@ router.get('/:workflowId/execution', async (req, res) => {
  * The workflow's input and output envelopes — two narrow lookups, no event
  * stream. Output is null with status 'running' until the workflow completes.
  */
-router.get('/:workflowId/envelopes', async (req, res) => {
+router.get('/:workflowId/envelopes', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowEnvelopes({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -110,9 +111,9 @@ router.get('/:workflowId/envelopes', async (req, res) => {
  * GET /api/workflow-states/:workflowId/status
  * Return only the numeric status semaphore.
  */
-router.get('/:workflowId/status', async (req, res) => {
+router.get('/:workflowId/status', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowStatus({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -120,9 +121,9 @@ router.get('/:workflowId/status', async (req, res) => {
  * GET /api/workflow-states/:workflowId/state
  * Return the current job state of the workflow.
  */
-router.get('/:workflowId/state', async (req, res) => {
+router.get('/:workflowId/state', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowState({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });

package/build/routes/file-browser.js

@@ -36,18 +36,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const path_1 = __importDefault(require("path"));
 const api = __importStar(require("../api/files"));
 const storage_1 = require("../lib/storage");
 const mime_1 = require("../lib/storage/mime");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/file-browser/browse
  * List files and directories at a given prefix.
  * Query: ?prefix=screenshots/&pageSize=100&continuationToken=...
  */
-router.get('/browse', async (req, res) => {
+router.get('/browse', auth_1.requireBuilder, async (req, res) => {
     const result = await api.browseFiles({
         prefix: req.query.prefix,
         pageSize: req.query.pageSize ? parseInt(req.query.pageSize, 10) : undefined,
@@ -59,7 +60,7 @@ router.get('/browse', async (req, res) => {
  * GET /api/file-browser/metadata/*
  * Get metadata for a single file.
  */
-router.get('/metadata/{*filePath}', async (req, res) => {
+router.get('/metadata/{*filePath}', auth_1.requireBuilder, async (req, res) => {
     const raw = req.params.filePath;
     const filePath = Array.isArray(raw) ? raw.join('/') : raw;
     if (!filePath) {
@@ -74,7 +75,7 @@ router.get('/metadata/{*filePath}', async (req, res) => {
  * Generate a time-limited signed URL for sharing.
  * Body: { path, expiresIn } — expiresIn in seconds (3600, 21600, 86400, 604800, 2592000)
  */
-router.post('/signed-url', async (req, res) => {
+router.post('/signed-url', auth_1.requireBuilder, async (req, res) => {
     const { path: filePath, expiresIn } = req.body;
     if (!filePath || !expiresIn) {
         res.status(400).json({ error: 'path and expiresIn are required' });
@@ -90,7 +91,7 @@ router.post('/signed-url', async (req, res) => {
  * DELETE /api/file-browser/delete/*
  * Permanently delete a file.
  */
-router.delete('/delete/{*filePath}', async (req, res) => {
+router.delete('/delete/{*filePath}', auth_1.requireBuilder, async (req, res) => {
     const raw = req.params.filePath;
     const filePath = Array.isArray(raw) ? raw.join('/') : raw;
     if (!filePath) {
@@ -104,7 +105,7 @@ router.delete('/delete/{*filePath}', async (req, res) => {
  * GET /api/file-browser/download/*
  * Download a file with Content-Disposition: attachment.
  */
-router.get('/download/{*filePath}', async (req, res) => {
+router.get('/download/{*filePath}', auth_1.requireBuilder, async (req, res) => {
     const raw = req.params.filePath;
     const filePath = Array.isArray(raw) ? raw.join('/') : raw;
     if (!filePath) {
@@ -129,7 +130,7 @@ router.get('/download/{*filePath}', async (req, res) => {
  * Query: ?path=images/photo.png (target path including filename)
  * Body: raw file bytes (Content-Type should match the file type)
  */
-router.post('/upload', async (req, res) => {
+router.post('/upload', auth_1.requireBuilder, async (req, res) => {
     const targetPath = req.query.path;
     if (!targetPath) {
         res.status(400).json({ error: 'path query parameter required (e.g., ?path=images/photo.png)' });

package/build/routes/files.js

@@ -3,11 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const storage_1 = require("../lib/storage");
 const mime_1 = require("../lib/storage/mime");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/files/*
  * Serve files from managed file storage.

package/build/routes/index.js

@@ -3,11 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const auth_2 = __importDefault(require("./auth"));
 const auth_sso_1 = __importDefault(require("./auth-sso"));
 const oauth_1 = __importDefault(require("./oauth"));
+const oauth_server_1 = __importDefault(require("./oauth-server"));
 const delegation_1 = __importDefault(require("./delegation"));
 const tasks_1 = __importDefault(require("./tasks"));
 const escalations_1 = __importDefault(require("./escalations"));
@@ -39,11 +40,12 @@ const nats_credentials_1 = __importDefault(require("./nats-credentials"));
 const scan_codes_1 = __importDefault(require("./scan-codes"));
 const domain_1 = __importDefault(require("./domain"));
 const announcements_1 = __importDefault(require("./announcements"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Public routes (no auth required — they handle their own auth)
 router.use('/auth', auth_2.default);
 router.use('/auth', auth_sso_1.default);
 router.use('/auth/oauth', oauth_1.default);
+router.use('/oauth', oauth_server_1.default);
 router.use('/delegation', delegation_1.default);
 router.use('/files', files_1.default);
 router.use('/settings', settings_1.default);

package/build/routes/insight.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/insight"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/insight/mcp-query
  * Run a general-purpose MCP query using all available tools.
@@ -52,7 +53,7 @@ router.post('/mcp-query', async (req, res) => {
  * The LLM reasons about tool schemas and constructs the YAML declaratively.
  * Body: { prompt: string, tags?: string[], wait?: boolean, feedback?: string, prior_yaml?: string }
  */
-router.post('/build-workflow', async (req, res) => {
+router.post('/build-workflow', auth_1.requireBuilder, async (req, res) => {
     const { prompt, tags, wait, feedback, prior_yaml, answers, prior_questions } = req.body;
     const result = await api.buildWorkflow({ prompt, tags, wait, feedback, prior_yaml, answers, prior_questions }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -62,7 +63,7 @@ router.post('/build-workflow', async (req, res) => {
  * Refine a previously built workflow using execution feedback.
  * Body: { prompt: string, prior_yaml: string, feedback: string, tags?: string[], wait?: boolean }
  */
-router.post('/build-workflow/refine', async (req, res) => {
+router.post('/build-workflow/refine', auth_1.requireBuilder, async (req, res) => {
     const { prompt, prior_yaml, feedback, tags, wait } = req.body;
     const result = await api.refineWorkflow({ prompt, prior_yaml, feedback, tags, wait }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });

package/build/routes/knowledge.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/knowledge"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // The knowledge store is a builder surface (superadmin or engineer) — the
 // same gate as the dashboard's Knowledge page. Members reach knowledge
 // content only through escalation lookup refs: an escalation's

package/build/routes/maintenance.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/maintenance"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/config/maintenance
  * Return the current maintenance configuration.

package/build/routes/mcp-endpoint.d.ts

@@ -6,7 +6,9 @@
  * streamable-http transport protocol.
  *
  * Stateless mode — each POST creates a fresh server+transport pair.
- * Auth via Bearer token (JWT or bot API key) in the Authorization header.
+ * Auth via Bearer token (JWT, bot API key, or OAuth access token) in the
+ * Authorization header.
+ * The caller sees only the tools whose manifest gate they hold.
  *
  * Mount at /mcp:
  *   POST /mcp  → JSON-RPC messages (initialize, tools/list, tools/call)

package/build/routes/mcp-endpoint.js

@@ -7,7 +7,9 @@
  * streamable-http transport protocol.
  *
  * Stateless mode — each POST creates a fresh server+transport pair.
- * Auth via Bearer token (JWT or bot API key) in the Authorization header.
+ * Auth via Bearer token (JWT, bot API key, or OAuth access token) in the
+ * Authorization header.
+ * The caller sees only the tools whose manifest gate they hold.
  *
  * Mount at /mcp:
  *   POST /mcp  → JSON-RPC messages (initialize, tools/list, tools/call)
@@ -15,19 +17,27 @@
  *   DELETE /mcp → 405 (no sessions in stateless mode)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
-const auth_1 = require("../modules/auth");
+const mcp_auth_1 = require("../modules/mcp-auth");
+const capabilities_1 = require("../modules/capabilities");
 const logger_1 = require("../lib/logger");
 const external_server_1 = require("../services/mcp/external-server");
 const exposure_1 = require("../services/mcp/exposure");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
+/** The tool a single `tools/call` message names; undefined for anything else. */
+function requestedToolName(body) {
+    const message = body;
+    if (message?.method !== 'tools/call')
+        return undefined;
+    return typeof message.params?.name === 'string' ? message.params.name : undefined;
+}
 // POST /mcp — JSON-RPC messages
-router.post('/', auth_1.requireAuth, async (req, res) => {
+router.post('/', mcp_auth_1.requireMcpAuth, async (req, res) => {
     try {
         const exposure = (0, exposure_1.getExposureConfig)();
         const callerScopes = req.auth?.scopes;
-        const server = await (0, external_server_1.createUnifiedMcpServer)(exposure, callerScopes);
+        const server = await (0, external_server_1.createUnifiedMcpServer)((0, capabilities_1.capabilityAccess)(req.auth), exposure, callerScopes, requestedToolName(req.body));
         const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
             sessionIdGenerator: undefined, // stateless
         });
@@ -53,7 +63,7 @@ router.post('/', auth_1.requireAuth, async (req, res) => {
     }
 });
 // GET /mcp — SSE stream (not supported in stateless mode)
-router.get('/', auth_1.requireAuth, (_req, res) => {
+router.get('/', mcp_auth_1.requireMcpAuth, (_req, res) => {
     res.status(405).json({
         jsonrpc: '2.0',
         error: { code: -32000, message: 'Method not allowed. Use POST for stateless requests.' },
@@ -61,7 +71,7 @@ router.get('/', auth_1.requireAuth, (_req, res) => {
     });
 });
 // DELETE /mcp — session close (not supported in stateless mode)
-router.delete('/', auth_1.requireAuth, (_req, res) => {
+router.delete('/', mcp_auth_1.requireMcpAuth, (_req, res) => {
     res.status(405).json({
         jsonrpc: '2.0',
         error: { code: -32000, message: 'Method not allowed. Stateless mode has no sessions.' },