@hotmeshio/long-tail 0.23.2 → 0.24.1

package/build/modules/mcp-auth.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireMcpAuth = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const auth_1 = require("./auth");
+const oauth_server_1 = require("./oauth-server");
+const oauth_server_2 = require("../services/auth/oauth-server");
+const CHALLENGE_HEADER = 'WWW-Authenticate';
+function bearerToken(req) {
+    const header = req.headers.authorization;
+    return header?.startsWith('Bearer ') ? header.slice(7) : null;
+}
+function isAccessToken(token) {
+    const decoded = jsonwebtoken_1.default.decode(token, { complete: true });
+    return decoded?.header?.typ === oauth_server_2.ACCESS_TOKEN_TYPE;
+}
+function challenge(settings, error) {
+    const base = `Bearer resource_metadata="${settings.resourceMetadataUrl}"`;
+    return error ? `${base}, error="${error}"` : base;
+}
+/**
+ * Authentication for `/mcp`. Only a credential the request carries itself
+ * authenticates: the host's SSO cookie fallback never applies here, since a
+ * cookie rides along on a request any page the person visits can send. With
+ * the OAuth server configured, an access token for this resource
+ * authenticates the request while its grant is live, and every 401 carries
+ * the RFC 9728 challenge so MCP clients can discover how to sign in. Any other
+ * credential goes through the configured auth adapter unchanged.
+ */
+const requireMcpAuth = async (req, res, next) => {
+    const settings = (0, oauth_server_1.getOAuthServerSettings)();
+    if (!settings)
+        return (0, auth_1.requireCredentialAuth)(req, res, next);
+    const token = bearerToken(req);
+    if (token && isAccessToken(token)) {
+        const claims = (0, oauth_server_2.verifyAccessToken)(token, { issuer: settings.issuer, audience: settings.resource });
+        const live = claims ? await (0, oauth_server_2.getLiveGrant)(claims.gid, claims.sub) : null;
+        if (!claims || !live || live.client_id !== claims.client_id) {
+            res.setHeader(CHALLENGE_HEADER, challenge(settings, 'invalid_token'));
+            res.status(401).json({ error: 'invalid_token' });
+            return;
+        }
+        req.auth = (0, oauth_server_2.accessTokenPrincipal)(claims, live);
+        next();
+        return;
+    }
+    res.setHeader(CHALLENGE_HEADER, challenge(settings));
+    return (0, auth_1.requireCredentialAuth)(req, res, (err) => {
+        res.removeHeader(CHALLENGE_HEADER);
+        next(err);
+    });
+};
+exports.requireMcpAuth = requireMcpAuth;

package/build/modules/oauth-server.d.ts

@@ -0,0 +1,18 @@
+import type { LTOAuthServerConfig } from '../types/oauth-server';
+/** The configured authorization server, with the URLs derived from its issuer. */
+export interface OAuthServerSettings {
+    issuer: string;
+    /** The protected resource, and the audience of its access tokens. */
+    resource: string;
+    /** RFC 9728 protected-resource metadata URL for `resource`. */
+    resourceMetadataUrl: string;
+    /** Canonical https redirect URIs allowed beyond loopback. */
+    allowedRedirectUris: string[];
+}
+/** An https URI in canonical form, or null when it is not one (a malformed entry never matches). */
+export declare function canonicalHttpsUri(uri: string): string | null;
+export declare function setOAuthServerConfig(config: LTOAuthServerConfig): void;
+/** Read per request: routers may be mounted before start() configures the server. */
+export declare function getOAuthServerSettings(): OAuthServerSettings | null;
+/** Reset. Used by tests. */
+export declare function clearOAuthServerConfig(): void;

package/build/modules/oauth-server.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalHttpsUri = canonicalHttpsUri;
+exports.setOAuthServerConfig = setOAuthServerConfig;
+exports.getOAuthServerSettings = getOAuthServerSettings;
+exports.clearOAuthServerConfig = clearOAuthServerConfig;
+/** An https URI in canonical form, or null when it is not one (a malformed entry never matches). */
+function canonicalHttpsUri(uri) {
+    try {
+        const url = new URL(uri);
+        if (url.protocol !== 'https:' || url.username || url.password || url.hash)
+            return null;
+        return url.href;
+    }
+    catch {
+        return null;
+    }
+}
+let settings = null;
+function setOAuthServerConfig(config) {
+    const issuer = config.issuer.replace(/\/+$/, '');
+    const resource = `${issuer}/mcp`;
+    const url = new URL(resource);
+    settings = {
+        issuer,
+        resource,
+        resourceMetadataUrl: `${url.origin}/.well-known/oauth-protected-resource${url.pathname}`,
+        allowedRedirectUris: (config.allowedRedirectUris ?? [])
+            .map(canonicalHttpsUri)
+            .filter((uri) => uri !== null),
+    };
+}
+/** Read per request: routers may be mounted before start() configures the server. */
+function getOAuthServerSettings() {
+    return settings;
+}
+/** Reset. Used by tests. */
+function clearOAuthServerConfig() {
+    settings = null;
+}

package/build/routes/agents.js

@@ -33,10 +33,26 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/agents"));
 const subApi = __importStar(require("../api/agent-subscriptions"));
-const router = (0, express_1.Router)();
+const auth_1 = require("../modules/auth");
+const authority_1 = require("../services/agent/authority");
+const workflow_invocation_1 = require("../services/workflow-invocation");
+const router = (0, http_1.Router)();
+/** Run an authority check; answer its refusal and return false when it refuses. */
+async function authorized(check, res) {
+    try {
+        await check();
+        return true;
+    }
+    catch (err) {
+        if (!(err instanceof workflow_invocation_1.InvocationError))
+            throw err;
+        res.status(err.statusCode).json({ error: err.message });
+        return false;
+    }
+}
 /**
  * GET /api/agents
  * List agents with optional filters.
@@ -63,12 +79,14 @@ router.get('/:id', async (req, res) => {
  * POST /api/agents
  * Create a new agent.
  */
-router.post('/', async (req, res) => {
+router.post('/', auth_1.requireBuilder, async (req, res) => {
     const { id } = req.body;
     if (!id) {
         res.status(400).json({ error: 'id is required (kebab-case agent name, e.g. "content-triage")' });
         return;
     }
+    if (!(await authorized(() => (0, authority_1.assertMayConfigureAgent)(req.auth.userId, { ...req.body, id: undefined }), res)))
+        return;
     const auth = { userId: req.userId, roles: req.roles };
     const result = await api.createAgent(req.body, auth);
     res.status(result.status).json(result.data ?? { error: result.error });
@@ -77,16 +95,19 @@ router.post('/', async (req, res) => {
  * PUT /api/agents/:id
  * Update an existing agent.
  */
-router.put('/:id', async (req, res) => {
-    const result = await api.updateAgent({ id: req.params.id, ...req.body });
+router.put('/:id', auth_1.requireBuilder, async (req, res) => {
+    const id = String(req.params.id);
+    if (!(await authorized(() => (0, authority_1.assertMayConfigureAgent)(req.auth.userId, { ...req.body, id }), res)))
+        return;
+    const result = await api.updateAgent({ ...req.body, id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * DELETE /api/agents/:id
  * Delete an agent.
  */
-router.delete('/:id', async (req, res) => {
-    const result = await api.deleteAgent({ id: req.params.id });
+router.delete('/:id', auth_1.requireBuilder, async (req, res) => {
+    const result = await api.deleteAgent({ id: String(req.params.id) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 // ── Subscription routes (nested under agent) ─────────────────────────────────
@@ -102,29 +123,41 @@ router.get('/:agentId/subscriptions', async (req, res) => {
  * POST /api/agents/:agentId/subscriptions
  * Create an event subscription for an agent.
  */
-router.post('/:agentId/subscriptions', async (req, res) => {
-    const { topic, reaction_type } = req.body;
+router.post('/:agentId/subscriptions', auth_1.requireBuilder, async (req, res) => {
+    const { topic, reaction_type, workflow_type, execute_as } = req.body;
     if (!topic || !reaction_type) {
         res.status(400).json({ error: 'topic and reaction_type are required' });
         return;
     }
-    const result = await subApi.createSubscription({ agentId: req.params.agentId, ...req.body });
+    const agentId = String(req.params.agentId);
+    const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, { agentId, reaction_type, workflow_type, execute_as });
+    if (!(await authorized(check, res)))
+        return;
+    const result = await subApi.createSubscription({ ...req.body, agentId });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * PUT /api/agents/:agentId/subscriptions/:subId
  * Update an event subscription.
  */
-router.put('/:agentId/subscriptions/:subId', async (req, res) => {
-    const result = await subApi.updateSubscription({ id: req.params.subId, ...req.body });
+router.put('/:agentId/subscriptions/:subId', auth_1.requireBuilder, async (req, res) => {
+    const agentId = String(req.params.agentId);
+    const id = String(req.params.subId);
+    const check = () => (0, authority_1.assertMayConfigureSubscription)(req.auth.userId, {
+        agentId, subscriptionId: id, reaction_type: req.body?.reaction_type,
+        workflow_type: req.body?.workflow_type, execute_as: req.body?.execute_as,
+    });
+    if (!(await authorized(check, res)))
+        return;
+    const result = await subApi.updateSubscription({ ...req.body, id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 /**
  * DELETE /api/agents/:agentId/subscriptions/:subId
  * Delete an event subscription.
  */
-router.delete('/:agentId/subscriptions/:subId', async (req, res) => {
-    const result = await subApi.deleteSubscription({ id: req.params.subId });
+router.delete('/:agentId/subscriptions/:subId', auth_1.requireBuilder, async (req, res) => {
+    const result = await subApi.deleteSubscription({ id: String(req.params.subId) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/announcements.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/announcements"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * Dashboard announcements. Publishing and removal are role-manager acts
  * (superadmin, admin type, or engineer); any authenticated user reads their

package/build/routes/auth-sso.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/auth-sso"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/auth/sso
  * Exchange host authentication for a Long Tail JWT.

package/build/routes/auth.js

@@ -33,9 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/auth"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/auth/login
  * Authenticate with username (external_id) and password.

package/build/routes/bot-accounts.js

@@ -33,10 +33,18 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
+const capabilities_1 = require("../modules/capabilities");
 const api = __importStar(require("../api/bot-accounts"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
+/** Answer a refused decision with 403; true when the request may go on. */
+function allowed(decision, res) {
+    if (decision.allowed)
+        return true;
+    res.status(403).json({ error: decision.error });
+    return false;
+}
 // All bot account routes require admin access
 router.use(auth_1.requireBuilder);
 // ── Bot CRUD ─────────────────────────────────────────────────────────────────
@@ -69,6 +77,8 @@ router.get('/:id', async (req, res) => {
  */
 router.post('/', async (req, res) => {
     const { name, description, display_name, roles } = req.body || {};
+    if (!allowed(await (0, capabilities_1.mayGrantRoles)(req.auth.userId, roles), res))
+        return;
     const result = await api.createBot({ name, description, display_name, roles }, req.auth ? { userId: req.auth.userId } : undefined);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -78,6 +88,8 @@ router.post('/', async (req, res) => {
  * Body: { display_name?, description?, status? }
  */
 router.put('/:id', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.updateBot({ id: req.params.id, ...(req.body || {}) });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -86,6 +98,8 @@ router.put('/:id', async (req, res) => {
  * Delete a bot account.
  */
 router.delete('/:id', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const result = await api.deleteBot({ id: req.params.id });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -105,6 +119,8 @@ router.get('/:id/roles', async (req, res) => {
  */
 router.post('/:id/roles', async (req, res) => {
     const { role, type } = req.body || {};
+    if (!allowed(await (0, capabilities_1.mayGrantRole)(req.auth.userId, { role, type }), res))
+        return;
     const result = await api.addBotRole({ id: req.params.id, role, type });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -113,6 +129,8 @@ router.post('/:id/roles', async (req, res) => {
  * Remove a role from a bot.
  */
 router.delete('/:id/roles/:role', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayRevokeRole)(req.auth.userId, String(req.params.id), String(req.params.role)), res))
+        return;
     const result = await api.removeBotRole({ id: req.params.id, role: req.params.role });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -132,6 +150,8 @@ router.get('/:id/api-keys', async (req, res) => {
  * Returns the raw key ONCE — it cannot be retrieved again.
  */
 router.post('/:id/api-keys', async (req, res) => {
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, String(req.params.id)), res))
+        return;
     const { name, scopes, expires_at } = req.body || {};
     const result = await api.createBotKey({
         id: req.params.id,
@@ -146,7 +166,10 @@ router.post('/:id/api-keys', async (req, res) => {
  * Revoke (delete) a bot API key.
  */
 router.delete('/:id/api-keys/:keyId', async (req, res) => {
-    const result = await api.revokeBotKey({ keyId: req.params.keyId });
+    const botId = String(req.params.id);
+    if (!allowed(await (0, capabilities_1.mayManageAccount)(req.auth.userId, botId), res))
+        return;
+    const result = await api.revokeBotKey({ keyId: String(req.params.keyId), botId });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/capabilities.js

@@ -33,15 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/capabilities"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/capabilities
  * List all platform capabilities grouped by category.
  */
-router.get('/', async (_req, res) => {
-    const result = await api.listCapabilities();
+router.get('/', async (req, res) => {
+    const result = await api.listCapabilities(req.auth);
     res.status(result.status).json(result.data ?? { error: result.error });
 });
 exports.default = router;

package/build/routes/controlplane.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/controlplane"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/controlplane/apps
  * List available HotMesh application namespaces.

package/build/routes/dba.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/dba"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * POST /api/dba/prune
  * Prune expired jobs, streams, and execution artifacts.

package/build/routes/delegation.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const delegation_1 = require("../services/auth/delegation");
 const service_token_1 = require("../services/auth/service-token");
 const oauth_1 = require("../services/oauth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/delegation/oauth/:provider/token
  *

package/build/routes/diagnostics.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const api = __importStar(require("../api/diagnostics"));
 const auth_1 = require("../modules/auth");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 const VALID_SECTIONS = new Set(['events', 'streams']);
 /** Parse a comma-separated `include` query param into the recognized heavy sections. */
 function parseInclude(raw) {

package/build/routes/docs.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 function projectRoot() {
     const candidates = [
         path.join(__dirname, '..'),

package/build/routes/domain.js

@@ -33,10 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
 const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/domain"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/domain
  * The deployment's domain dictionary: `{ doc, version, updated_at }`, or

package/build/routes/escalations/accumulate.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Open-accumulator routes. The literal single-segment paths are registered
  * before the parameterized routes so /:id never shadows them; the /:id/*

package/build/routes/escalations/acting.d.ts

@@ -1,4 +1,4 @@
-import type { Request, Response } from 'express';
+import type { Request, Response } from '../../lib/http';
 import type { LTApiAuth } from '../../types/sdk';
 /** The header a shared station device rides its badge grant on. */
 export declare const ACTING_TOKEN_HEADER = "x-lt-acting-token";

package/build/routes/escalations/analytics.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Escalation analytics HTTP surface — grouped membership/dwell aggregates and
  * per-entity timelines over the interval time-series. Read-only; the api layer

package/build/routes/escalations/bulk.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerBulkRoutes(router: Router): void;

package/build/routes/escalations/facets.d.ts

@@ -1,4 +1,4 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 /**
  * Faceted-routing HTTP surface — pond search + batch claim. Each operation targets a
  * single pond `role` and is RBAC-scoped to it (the api layer enforces the gate). These

package/build/routes/escalations/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../../lib/http");
 const list_1 = require("./list");
 const bulk_1 = require("./bulk");
 const metadata_1 = require("./metadata");
@@ -10,7 +10,7 @@ const resolve_1 = require("./resolve");
 const facets_1 = require("./facets");
 const analytics_1 = require("./analytics");
 const related_1 = require("./related");
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 // Registration order matters: literal paths before parameterized /:id routes.
 // GET /, /available, /types, /stats
 (0, list_1.registerListRoutes)(router);

package/build/routes/escalations/list.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerListRoutes(router: Router): void;

package/build/routes/escalations/metadata.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Register metadata-based escalation lookup routes.
  * Must be registered BEFORE parameterized /:id routes.

package/build/routes/escalations/related.d.ts

@@ -1,4 +1,4 @@
-import type { Router } from 'express';
+import type { Router } from '../../lib/http';
 /**
  * Related sets for role list views. The role's stored list schema declares
  * the sets; the caller names the role, the page's host rows, and the schema

package/build/routes/escalations/resolve.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerResolveRoutes(router: Router): void;

package/build/routes/escalations/single.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import { Router } from '../../lib/http';
 export declare function registerSingleRoutes(router: Router): void;

package/build/routes/escalations/single.js

@@ -53,7 +53,7 @@ function registerSingleRoutes(router) {
     router.get('/by-workflow/:workflowId', async (req, res) => {
         const result = await api.getEscalationsByWorkflowId({
             workflowId: req.params.workflowId,
-        });
+        }, req.auth);
         res.status(result.status).json(result.data ?? { error: result.error });
     });
     // -- Parameterized routes (must come after literal paths) --

package/build/routes/exports.js

@@ -33,14 +33,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const express_1 = require("express");
+const http_1 = require("../lib/http");
+const auth_1 = require("../modules/auth");
 const api = __importStar(require("../api/exports"));
-const router = (0, express_1.Router)();
+const router = (0, http_1.Router)();
 /**
  * GET /api/workflow-states/jobs
  * List workflow jobs with optional filtering and pagination.
  */
-router.get('/jobs', async (req, res) => {
+router.get('/jobs', auth_1.requireBuilder, async (req, res) => {
     const app_id = (req.query.app_id || req.query.namespace);
     if (!app_id) {
         res.status(400).json({ error: 'app_id (or namespace) query parameter is required' });
@@ -63,7 +64,7 @@ router.get('/jobs', async (req, res) => {
  * GET /api/workflow-states/:workflowId
  * Export the full workflow state using HotMesh's durable export.
  */
-router.get('/:workflowId', async (req, res) => {
+router.get('/:workflowId', auth_1.requireBuilder, async (req, res) => {
     const allow = req.query.allow
         ? req.query.allow.split(',')
         : undefined;
@@ -72,7 +73,7 @@ router.get('/:workflowId', async (req, res) => {
         : undefined;
     const values = req.query.values === 'false' ? false : undefined;
     const result = await api.exportWorkflowState({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         allow,
         block,
         values,
@@ -83,9 +84,9 @@ router.get('/:workflowId', async (req, res) => {
  * GET /api/workflow-states/:workflowId/execution
  * Export workflow state as a structured execution event history.
  */
-router.get('/:workflowId/execution', async (req, res) => {
+router.get('/:workflowId/execution', auth_1.requireWorkflowReader, async (req, res) => {
     const result = await api.exportWorkflowExecution({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
         excludeSystem: req.query.excludeSystem === 'true',
         omitResults: req.query.omitResults === 'true',
         mode: req.query.mode || undefined,
@@ -100,9 +101,9 @@ router.get('/:workflowId/execution', async (req, res) => {
  * The workflow's input and output envelopes — two narrow lookups, no event
  * stream. Output is null with status 'running' until the workflow completes.
  */
-router.get('/:workflowId/envelopes', async (req, res) => {
+router.get('/:workflowId/envelopes', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowEnvelopes({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -110,9 +111,9 @@ router.get('/:workflowId/envelopes', async (req, res) => {
  * GET /api/workflow-states/:workflowId/status
  * Return only the numeric status semaphore.
  */
-router.get('/:workflowId/status', async (req, res) => {
+router.get('/:workflowId/status', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowStatus({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });
@@ -120,9 +121,9 @@ router.get('/:workflowId/status', async (req, res) => {
  * GET /api/workflow-states/:workflowId/state
  * Return the current job state of the workflow.
  */
-router.get('/:workflowId/state', async (req, res) => {
+router.get('/:workflowId/state', auth_1.requireBuilder, async (req, res) => {
     const result = await api.getWorkflowState({
-        workflowId: req.params.workflowId,
+        workflowId: String(req.params.workflowId),
     });
     res.status(result.status).json(result.data ?? { error: result.error });
 });