create-workframe 0.1.12 → 0.1.13

package/workframe-api/route_registry.py

@@ -1,9 +1,11 @@
 """Declarative API route registry (WF-037).
 
 Deny-by-default auth tiers plus batched handler dispatch; handler bodies live on server.Handler.
+Unknown /api/* paths pass auth and return 404 at dispatch; registered paths without auth → 401.
 """
 from __future__ import annotations
 
+import re
 from dataclasses import dataclass
 from enum import Enum
 from typing import Any
@@ -11,178 +13,276 @@ from typing import Any
 
 class AuthLevel(str, Enum):
     PUBLIC = "public"
-    SINGLE_USER_GET = "single_user_get"
-    AUTH_FLOW = "auth_flow"
-    INSTALL = "install"
     SESSION = "session"
+    ROLE_OWNER_ADMIN = "role_owner_admin"
+    INTERNAL = "internal"
 
 
-GET_ALWAYS_PUBLIC_ROUTES = frozenset({
-    "/api/meta",
-    "/api/health",
-    "/api/setup/status",
-    "/api/install/status",
-    "/api/public/site-meta",
-    "/api/public/link-preview",
-    "/api/public/manifest.webmanifest",
-    "/api/auth/google/callback",
-})
-
-GET_SINGLE_USER_PUBLIC_ROUTES = frozenset({
-    "/api/files/read",
-    "/api/files/raw",
-    "/api/files/tree",
-    "/api/files/list",
-    "/api/files/state",
-    "/api/board",
-    "/api/content",
-    "/api/content/get",
-    "/api/agents",
-    "/api/snapshot",
-    "/api/hermes/usage",
-    "/api/hermes/profile",
-    "/api/hermes/debug",
-    "/api/hermes/insights",
-    "/api/hermes/gquota",
-    "/api/hermes/models",
-    "/api/hermes/skills",
-    "/api/hermes/commands",
-    "/api/routes",
-    "/api/chat/session",
-    "/api/chat/resolve",
-    "/api/chat/messages",
-    "/api/profiles",
-})
-
-AUTH_FLOW_POST_ROUTES = frozenset({
-    "/api/auth/start",
-    "/api/auth/verify",
-    "/api/auth/logout",
-    "/api/auth/refresh",
-    "/api/auth/bootstrap",
-    "/api/setup",
-    "/api/auth/google/start",
-    "/api/auth/local-bootstrap",
-})
-
 @dataclass(frozen=True, slots=True)
 class Route:
     method: str
     path: str
-    handler: str
     auth: AuthLevel
+    handler: str | None = None
+    sessionless_ok: bool = False
+    install_window: bool = False
+
 
+@dataclass(frozen=True, slots=True)
+class RoutePattern:
+    method: str
+    pattern: re.Pattern[str]
+    label: str
+    auth: AuthLevel
+    sessionless_ok: bool = False
+    install_window: bool = False
+    handler: str | None = None
 
-# Batch: data-read GET surfaces (handler methods on server.Handler).
+
+# Exact routes — handler set when dispatched via registry; auth always required.
 ROUTES: tuple[Route, ...] = (
-    Route("GET", "/api/meta", "_route_get_meta", AuthLevel.PUBLIC),
-    Route("GET", "/api/health", "_route_get_health", AuthLevel.PUBLIC),
-    Route("GET", "/api/setup/status", "_route_get_setup_status", AuthLevel.PUBLIC),
-    Route("GET", "/api/install/status", "_route_get_install_status", AuthLevel.PUBLIC),
-    Route("GET", "/api/public/site-meta", "_route_get_public_site_meta", AuthLevel.PUBLIC),
-    Route("GET", "/api/public/link-preview", "_route_get_public_link_preview", AuthLevel.PUBLIC),
-    Route("GET", "/api/public/manifest.webmanifest", "_route_get_public_manifest", AuthLevel.PUBLIC),
-    Route("GET", "/api/agents", "_route_get_agents", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/snapshot", "_route_get_snapshot", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/activity/detail", "_route_get_activity_detail", AuthLevel.SESSION),
-    Route("GET", "/api/board", "_route_get_board", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/content", "_route_get_content", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/content/get", "_route_get_content_get", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/files/tree", "_route_get_files_tree", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/files/list", "_route_get_files_list", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/files/state", "_route_get_files_state", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/files/read", "_route_get_files_read", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/files/raw", "_route_get_files_raw", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/routes", "_route_get_routes", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/chat/messages", "_route_get_chat_messages", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/chat/session", "_route_get_chat_session", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/chat/resolve", "_route_get_chat_resolve", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/hermes/skills", "_route_get_hermes_skills", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/hermes/commands", "_route_get_hermes_commands", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/hermes/usage", "_route_get_hermes_usage", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/hermes/profile", "_route_get_hermes_profile", AuthLevel.SINGLE_USER_GET),
-    # Batch 3: session /me + hermes catalog GET surfaces
-    Route("GET", "/api/me", "_route_get_me", AuthLevel.SESSION),
-    Route("GET", "/api/me/onboarding", "_route_get_me_onboarding", AuthLevel.SESSION),
-    Route("GET", "/api/me/credentials", "_route_get_me_credentials", AuthLevel.SESSION),
-    Route("GET", "/api/me/providers", "_route_get_me_providers", AuthLevel.SESSION),
-    Route("GET", "/api/hermes/models", "_route_get_hermes_models", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/hermes/debug", "_route_get_hermes_debug", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/hermes/insights", "_route_get_hermes_insights", AuthLevel.SINGLE_USER_GET),
-    Route("GET", "/api/hermes/gquota", "_route_get_hermes_gquota", AuthLevel.SINGLE_USER_GET),
-    # Batch 4: session cohort + legacy user credentials
-    Route("GET", "/api/me/cohort", "_route_get_me_cohort", AuthLevel.SESSION),
-    Route("GET", "/api/user/credentials", "_route_get_user_credentials", AuthLevel.SESSION),
-    # Batch 2: auth-flow + hermes/chat + me credentials POST surfaces
-    Route("POST", "/api/auth/start", "_route_post_auth_start", AuthLevel.AUTH_FLOW),
-    Route("POST", "/api/auth/verify", "_route_post_auth_verify", AuthLevel.AUTH_FLOW),
-    Route("POST", "/api/auth/logout", "_route_post_auth_logout", AuthLevel.AUTH_FLOW),
-    Route("POST", "/api/auth/refresh", "_route_post_auth_refresh", AuthLevel.AUTH_FLOW),
-    Route("POST", "/api/auth/bootstrap", "_route_post_auth_bootstrap", AuthLevel.AUTH_FLOW),
-    Route("POST", "/api/auth/google/start", "_route_post_auth_google_start", AuthLevel.AUTH_FLOW),
-    Route("POST", "/api/auth/local-bootstrap", "_route_post_auth_local_bootstrap", AuthLevel.AUTH_FLOW),
-    Route("POST", "/api/setup", "_route_post_setup", AuthLevel.AUTH_FLOW),
-    Route("POST", "/api/hermes/model", "_route_post_hermes_model", AuthLevel.SESSION),
-    Route("POST", "/api/hermes/model/apply-default", "_route_post_hermes_model_apply_default", AuthLevel.SESSION),
-    Route("POST", "/api/hermes/fallback-chain", "_route_post_hermes_fallback_chain", AuthLevel.SESSION),
-    Route("POST", "/api/hermes/commands/exec", "_route_post_hermes_commands_exec", AuthLevel.SESSION),
-    Route("POST", "/api/hermes/gateway/exec", "_route_post_hermes_gateway_exec", AuthLevel.SESSION),
-    Route("POST", "/api/chat/stop", "_route_post_chat_stop", AuthLevel.SESSION),
-    Route("POST", "/api/chat/steer", "_route_post_chat_steer", AuthLevel.SESSION),
-    Route("POST", "/api/me/credentials", "_route_post_me_credentials", AuthLevel.SESSION),
-    Route("POST", "/api/me/telegram/link", "_route_post_me_telegram_link", AuthLevel.SESSION),
-    Route("POST", "/api/board", "_route_post_board", AuthLevel.SESSION),
-    # Batch 5: workspace mutation POST surfaces
-    Route("POST", "/api/board/update", "_route_post_board_update", AuthLevel.SESSION),
-    Route("POST", "/api/board/delete", "_route_post_board_delete", AuthLevel.SESSION),
-    Route("POST", "/api/content/save", "_route_post_content_save", AuthLevel.SESSION),
-    Route("POST", "/api/content/delete", "_route_post_content_delete", AuthLevel.SESSION),
-    Route("POST", "/api/files/write", "_route_post_files_write", AuthLevel.SESSION),
-    Route("POST", "/api/files/upload", "_route_post_files_upload", AuthLevel.SESSION),
-    Route("POST", "/api/chat/dispatch", "_route_post_chat_dispatch", AuthLevel.SESSION),
+    # --- public GET ---
+    Route("GET", "/api/meta", AuthLevel.PUBLIC, "_route_get_meta"),
+    Route("GET", "/api/health", AuthLevel.PUBLIC, "_route_get_health"),
+    Route("GET", "/api/setup/status", AuthLevel.PUBLIC, "_route_get_setup_status"),
+    Route("GET", "/api/install/status", AuthLevel.PUBLIC, "_route_get_install_status"),
+    Route("GET", "/api/public/site-meta", AuthLevel.PUBLIC, "_route_get_public_site_meta"),
+    Route("GET", "/api/public/link-preview", AuthLevel.PUBLIC, "_route_get_public_link_preview"),
+    Route("GET", "/api/public/manifest.webmanifest", AuthLevel.PUBLIC, "_route_get_public_manifest"),
+    Route("GET", "/api/auth/hermes-dashboard-gate", AuthLevel.PUBLIC, "_route_get_auth_hermes_dashboard_gate"),
+    Route("GET", "/api/auth/google/callback", AuthLevel.PUBLIC, "_route_get_auth_google_callback"),
+    # --- sessionless_ok GET (single_user_local / DEV_LOCAL_UNSAFE) ---
+    Route("GET", "/api/agents", AuthLevel.SESSION, "_route_get_agents", sessionless_ok=True),
+    Route("GET", "/api/snapshot", AuthLevel.SESSION, "_route_get_snapshot", sessionless_ok=True),
+    Route("GET", "/api/board", AuthLevel.SESSION, "_route_get_board", sessionless_ok=True),
+    Route("GET", "/api/content", AuthLevel.SESSION, "_route_get_content", sessionless_ok=True),
+    Route("GET", "/api/content/get", AuthLevel.SESSION, "_route_get_content_get", sessionless_ok=True),
+    Route("GET", "/api/files/tree", AuthLevel.SESSION, "_route_get_files_tree", sessionless_ok=True),
+    Route("GET", "/api/files/list", AuthLevel.SESSION, "_route_get_files_list", sessionless_ok=True),
+    Route("GET", "/api/files/state", AuthLevel.SESSION, "_route_get_files_state", sessionless_ok=True),
+    Route("GET", "/api/files/read", AuthLevel.SESSION, "_route_get_files_read", sessionless_ok=True),
+    Route("GET", "/api/files/raw", AuthLevel.SESSION, "_route_get_files_raw", sessionless_ok=True),
+    Route("GET", "/api/routes", AuthLevel.SESSION, "_route_get_routes", sessionless_ok=True),
+    Route("GET", "/api/chat/messages", AuthLevel.SESSION, "_route_get_chat_messages", sessionless_ok=True),
+    Route("GET", "/api/chat/session", AuthLevel.SESSION, "_route_get_chat_session", sessionless_ok=True),
+    Route("GET", "/api/chat/resolve", AuthLevel.SESSION, "_route_get_chat_resolve", sessionless_ok=True),
+    Route("GET", "/api/hermes/skills", AuthLevel.SESSION, "_route_get_hermes_skills", sessionless_ok=True),
+    Route("GET", "/api/hermes/commands", AuthLevel.SESSION, "_route_get_hermes_commands", sessionless_ok=True),
+    Route("GET", "/api/hermes/usage", AuthLevel.SESSION, "_route_get_hermes_usage", sessionless_ok=True),
+    Route("GET", "/api/hermes/profile", AuthLevel.SESSION, "_route_get_hermes_profile", sessionless_ok=True),
+    Route("GET", "/api/hermes/models", AuthLevel.SESSION, "_route_get_hermes_models", sessionless_ok=True),
+    Route("GET", "/api/hermes/debug", AuthLevel.SESSION, "_route_get_hermes_debug", sessionless_ok=True),
+    Route("GET", "/api/hermes/insights", AuthLevel.SESSION, "_route_get_hermes_insights", sessionless_ok=True),
+    Route("GET", "/api/hermes/gquota", AuthLevel.SESSION, "_route_get_hermes_gquota", sessionless_ok=True),
+    # --- session GET ---
+    Route("GET", "/api/activity/detail", AuthLevel.SESSION, "_route_get_activity_detail"),
+    Route("GET", "/api/me", AuthLevel.SESSION, "_route_get_me"),
+    Route("GET", "/api/me/onboarding", AuthLevel.SESSION, "_route_get_me_onboarding"),
+    Route("GET", "/api/me/credentials", AuthLevel.SESSION, "_route_get_me_credentials"),
+    Route("GET", "/api/me/providers", AuthLevel.SESSION, "_route_get_me_providers"),
+    Route("GET", "/api/me/cohort", AuthLevel.SESSION, "_route_get_me_cohort"),
+    Route("GET", "/api/user/credentials", AuthLevel.SESSION, "_route_get_user_credentials"),
+    Route("GET", "/api/hermes/profiles/status", AuthLevel.SESSION, "_route_get_hermes_profiles_status"),
+    Route("GET", "/api/oauth/github/callback", AuthLevel.SESSION, "_route_get_oauth_github_callback"),
+    Route("GET", "/api/oauth/discord/callback", AuthLevel.SESSION, "_route_get_oauth_discord_callback"),
+    Route("GET", "/api/oauth/stripe/callback", AuthLevel.SESSION, "_route_get_oauth_stripe_callback"),
+    Route("GET", "/api/events", AuthLevel.SESSION, "_route_get_events"),
+    Route("GET", "/events", AuthLevel.SESSION, "_route_get_events"),
+    # --- owner/admin GET ---
+    Route("GET", "/api/chat/bootstrap", AuthLevel.ROLE_OWNER_ADMIN, "_route_get_chat_bootstrap"),
+    Route("GET", "/api/hermes/bootstrap", AuthLevel.ROLE_OWNER_ADMIN, "_route_get_hermes_bootstrap"),
+    Route("GET", "/api/admin/vault/status", AuthLevel.ROLE_OWNER_ADMIN, "_route_get_admin_vault_status"),
+    Route("GET", "/api/doctor/agent-dm-runtimes", AuthLevel.ROLE_OWNER_ADMIN, "_route_get_doctor_agent_dm_runtimes"),
+    Route("GET", "/api/admin/updates", AuthLevel.ROLE_OWNER_ADMIN, "_route_get_admin_updates"),
+    Route("GET", "/api/admin/audit", AuthLevel.ROLE_OWNER_ADMIN, "_route_get_admin_audit"),
+    # --- install-window GET ---
+    Route("GET", "/api/install/publish-hints", AuthLevel.PUBLIC, "_route_get_install_publish_hints", install_window=True),
+    Route("GET", "/api/install/url/test", AuthLevel.PUBLIC, "_route_get_install_url_test", install_window=True),
+    Route("GET", "/api/install/stack", AuthLevel.SESSION, "_route_get_install_stack", install_window=True),
+    # --- internal GET ---
+    Route("GET", "/api/supervisor/v1/profile.status", AuthLevel.SESSION, "_route_get_supervisor_profile_status"),
+    Route("GET", "/api/supervisor/v1/stack.status", AuthLevel.SESSION, "_route_get_supervisor_stack_status"),
+    # --- public POST (auth flow) ---
+    Route("POST", "/api/auth/start", AuthLevel.PUBLIC, "_route_post_auth_start"),
+    Route("POST", "/api/auth/verify", AuthLevel.PUBLIC, "_route_post_auth_verify"),
+    Route("POST", "/api/auth/logout", AuthLevel.PUBLIC, "_route_post_auth_logout"),
+    Route("POST", "/api/auth/refresh", AuthLevel.PUBLIC, "_route_post_auth_refresh"),
+    Route("POST", "/api/auth/bootstrap", AuthLevel.PUBLIC, "_route_post_auth_bootstrap"),
+    Route("POST", "/api/auth/google/start", AuthLevel.PUBLIC, "_route_post_auth_google_start"),
+    Route("POST", "/api/auth/local-bootstrap", AuthLevel.PUBLIC, "_route_post_auth_local_bootstrap"),
+    Route("POST", "/api/setup", AuthLevel.PUBLIC, "_route_post_setup"),
+    # --- session POST ---
+    Route("POST", "/api/hermes/model", AuthLevel.SESSION, "_route_post_hermes_model"),
+    Route("POST", "/api/hermes/model/apply-default", AuthLevel.SESSION, "_route_post_hermes_model_apply_default"),
+    Route("POST", "/api/hermes/fallback-chain", AuthLevel.SESSION, "_route_post_hermes_fallback_chain"),
+    Route("POST", "/api/hermes/commands/exec", AuthLevel.SESSION, "_route_post_hermes_commands_exec"),
+    Route("POST", "/api/hermes/gateway/exec", AuthLevel.SESSION, "_route_post_hermes_gateway_exec"),
+    Route("POST", "/api/chat/stop", AuthLevel.SESSION, "_route_post_chat_stop"),
+    Route("POST", "/api/chat/steer", AuthLevel.SESSION, "_route_post_chat_steer"),
+    Route("POST", "/api/me/credentials", AuthLevel.SESSION, "_route_post_me_credentials"),
+    Route("POST", "/api/me/telegram/link", AuthLevel.SESSION, "_route_post_me_telegram_link"),
+    Route("POST", "/api/board", AuthLevel.SESSION, "_route_post_board"),
+    Route("POST", "/api/board/update", AuthLevel.SESSION, "_route_post_board_update"),
+    Route("POST", "/api/board/delete", AuthLevel.SESSION, "_route_post_board_delete"),
+    Route("POST", "/api/content/save", AuthLevel.SESSION, "_route_post_content_save"),
+    Route("POST", "/api/content/delete", AuthLevel.SESSION, "_route_post_content_delete"),
+    Route("POST", "/api/files/write", AuthLevel.SESSION, "_route_post_files_write"),
+    Route("POST", "/api/files/upload", AuthLevel.SESSION, "_route_post_files_upload"),
+    Route("POST", "/api/chat/dispatch", AuthLevel.SESSION, "_route_post_chat_dispatch"),
+    Route("POST", "/api/hermes/profiles/create", AuthLevel.SESSION, "_route_post_hermes_profiles_create"),
+    Route("POST", "/api/hermes/profiles/start", AuthLevel.SESSION, "_route_post_hermes_profiles_start"),
+    Route("POST", "/api/hermes/profiles/stop", AuthLevel.SESSION, "_route_post_hermes_profiles_stop"),
+    Route("POST", "/api/hermes/profiles/delete", AuthLevel.SESSION, "_route_post_hermes_profiles_delete"),
+    Route("POST", "/api/hermes/profiles/disable", AuthLevel.SESSION, "_route_post_hermes_profiles_disable"),
+    Route("POST", "/api/supervisor/v1/profile.start", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_supervisor_profile_start"),
+    Route("POST", "/api/supervisor/v1/profile.stop", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_supervisor_profile_stop"),
+    Route("POST", "/api/supervisor/v1/profile.disable", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_supervisor_profile_disable"),
+    # --- owner/admin POST ---
+    Route("POST", "/api/admin/updates/apply", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_admin_updates_apply"),
+    Route("POST", "/api/admin/stack/restart-gateway", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_admin_stack_restart_gateway"),
+    Route("POST", "/api/admin/vault/init", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_admin_vault_init"),
+    Route("POST", "/api/admin/vault/unlock", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_admin_vault_unlock"),
+    Route("POST", "/api/admin/vault/seal", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_admin_vault_seal"),
+    Route("POST", "/api/admin/vault/wipe", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_admin_vault_wipe"),
+    Route("POST", "/api/install/stack/branding-asset", AuthLevel.ROLE_OWNER_ADMIN, "_route_post_install_stack_branding_asset"),
+    # --- install-window POST ---
+    Route("POST", "/api/install/email/test", AuthLevel.PUBLIC, "_route_post_install_email_test", install_window=True),
+    Route("POST", "/api/install/url/test", AuthLevel.PUBLIC, "_route_post_install_url_test", install_window=True),
+    Route("POST", "/api/install/setup-https", AuthLevel.PUBLIC, "_route_post_install_setup_https", install_window=True),
+    Route("POST", "/api/install/complete", AuthLevel.PUBLIC, "_route_post_install_complete", install_window=True),
+    # --- PATCH ---
+    Route("PATCH", "/api/me", AuthLevel.SESSION, "_route_patch_me"),
+    Route("PATCH", "/api/me/native-agent", AuthLevel.SESSION, "_route_patch_me_native_agent"),
+    Route("PATCH", "/api/doctor/repair", AuthLevel.ROLE_OWNER_ADMIN, "_route_patch_doctor_repair"),
+    Route("PATCH", "/api/install/stack", AuthLevel.SESSION, "_route_patch_install_stack", install_window=True),
+)
+
+_ROUTE_PATTERNS_RAW: tuple[tuple, ...] = (
+    # method, regex, label, auth, sessionless_ok, install_window [, handler]
+    ("GET", r"^/api/files/workspace/.+", "/api/files/workspace/{path}", AuthLevel.SESSION, True, False, "_route_pattern_get_files_workspace"),
+    ("GET", r"^/api/public/branding/(og|favicon)$", "/api/public/branding/{kind}", AuthLevel.PUBLIC, False, False, "_route_pattern_get_public_branding"),
+    ("GET", r"^/api/workspace/[^/]+$", "/api/workspace/{id}", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace"),
+    ("GET", r"^/api/workspace/[^/]+/rooms$", "/api/workspace/{id}/rooms", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_rooms"),
+    ("GET", r"^/api/rooms/[^/]+$", "/api/rooms/{id}", AuthLevel.SESSION, False, False, "_route_pattern_get_room"),
+    ("GET", r"^/api/rooms/[^/]+/members$", "/api/rooms/{id}/members", AuthLevel.SESSION, False, False, "_route_pattern_get_room_members"),
+    ("GET", r"^/api/rooms/[^/]+/live$", "/api/rooms/{id}/live", AuthLevel.SESSION, False, False, "_route_pattern_get_room_live"),
+    ("GET", r"^/api/rooms/[^/]+/activity$", "/api/rooms/{id}/activity", AuthLevel.SESSION, False, False, "_route_pattern_get_room_activity"),
+    ("GET", r"^/api/workspace/[^/]+/activity$", "/api/workspace/{id}/activity", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_activity"),
+    ("GET", r"^/api/workspace/[^/]+/kanban/tasks$", "/api/workspace/{id}/kanban/tasks", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_kanban_tasks"),
+    ("GET", r"^/api/workspace/[^/]+/delegation-grants$", "/api/workspace/{id}/delegation-grants", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_delegation_grants"),
+    ("GET", r"^/api/rooms/[^/]+/sessions$", "/api/rooms/{id}/sessions", AuthLevel.SESSION, False, False, "_route_pattern_get_room_sessions"),
+    ("GET", r"^/api/workspace/[^/]+/invites$", "/api/workspace/{id}/invites", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_invites"),
+    ("GET", r"^/api/invites/[^/]+$", "/api/invites/{token}", AuthLevel.SESSION, False, False, "_route_pattern_get_invite"),
+    ("GET", r"^/api/workspace/[^/]+/members$", "/api/workspace/{id}/members", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_members"),
+    ("GET", r"^/api/workspace/[^/]+/memory$", "/api/workspace/{id}/memory", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_memory"),
+    ("GET", r"^/api/workspace/[^/]+/budget$", "/api/workspace/{id}/budget", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_budget"),
+    ("GET", r"^/api/workspace/[^/]+/grants$", "/api/workspace/{id}/grants", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_grants"),
+    ("GET", r"^/api/rooms/[^/]+/messages$", "/api/rooms/{id}/messages", AuthLevel.SESSION, False, False, "_route_pattern_get_room_messages"),
+    ("GET", r"^/api/workspace/[^/]+/events$", "/api/workspace/{id}/events", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_events"),
+    ("GET", r"^/api/me/oauth/[^/]+/status$", "/api/me/oauth/{provider}/status", AuthLevel.SESSION, False, False, "_route_pattern_get_me_oauth_status"),
+    ("GET", r"^/api/hermes/profiles/[^/]+/soul$", "/api/hermes/profiles/{slug}/soul", AuthLevel.SESSION, False, False, "_route_pattern_get_hermes_profile_soul"),
+    ("GET", r"^/api/hermes/profiles/[^/]+/sessions$", "/api/hermes/profiles/{slug}/sessions", AuthLevel.SESSION, False, False, "_route_pattern_get_hermes_profile_sessions"),
+    ("GET", r"^/api/hermes/profiles/[^/]+/bind$", "/api/hermes/profiles/{slug}/bind", AuthLevel.SESSION, False, False, "_route_pattern_get_hermes_profile_bind"),
+    ("GET", r"^/api/hermes/profiles/[^/]+$", "/api/hermes/profiles/{slug}", AuthLevel.SESSION, False, False, "_route_pattern_get_hermes_profile_detail"),
+    ("GET", r"^/api/workspace/[^/]+/credentials$", "/api/workspace/{id}/credentials", AuthLevel.SESSION, False, False, "_route_pattern_get_workspace_credentials"),
+    ("GET", r"^/api/agents/[^/]+/credentials$", "/api/agents/{id}/credentials", AuthLevel.SESSION, False, False, "_route_pattern_get_agent_credentials"),
+    ("POST", r"^/api/me/oauth/[^/]+/start$", "/api/me/oauth/{provider}/start", AuthLevel.SESSION, False, False, "_route_pattern_post_me_oauth_start"),
+    ("POST", r"^/api/me/providers/[^/]+/disconnect$", "/api/me/providers/{id}/disconnect", AuthLevel.SESSION, False, False, "_route_pattern_post_me_providers_disconnect"),
+    ("POST", r"^/api/workspace/[^/]+/credentials/store$", "/api/workspace/{id}/credentials/store", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_credentials_store"),
+    ("POST", r"^/api/workspace/[^/]+/credentials/[^/]+/revoke$", "/api/workspace/{id}/credentials/{cid}/revoke", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_credentials_revoke"),
+    ("POST", r"^/api/workspace/[^/]+/rooms$", "/api/workspace/{id}/rooms", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_rooms"),
+    ("POST", r"^/api/workspace/[^/]+/rooms/create$", "/api/workspace/{id}/rooms/create", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_rooms_create"),
+    ("POST", r"^/api/rooms/[^/]+/members$", "/api/rooms/{id}/members", AuthLevel.SESSION, False, False, "_route_pattern_post_room_members"),
+    ("POST", r"^/api/rooms/[^/]+/bind$", "/api/rooms/{id}/bind", AuthLevel.SESSION, False, False, "_route_pattern_post_room_bind"),
+    ("POST", r"^/api/rooms/[^/]+/sessions/activate$", "/api/rooms/{id}/sessions/activate", AuthLevel.SESSION, False, False, "_route_pattern_post_room_sessions_activate"),
+    ("POST", r"^/api/rooms/[^/]+/messages/send$", "/api/rooms/{id}/messages/send", AuthLevel.SESSION, False, False, "_route_pattern_post_room_messages_send"),
+    ("POST", r"^/api/workspace/[^/]+/invites$", "/api/workspace/{id}/invites", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_invites"),
+    ("POST", r"^/api/invites/[^/]+/accept$", "/api/invites/{token}/accept", AuthLevel.SESSION, False, False, "_route_pattern_post_invites_accept"),
+    ("POST", r"^/api/workspace/[^/]+/members$", "/api/workspace/{id}/members", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_members"),
+    ("POST", r"^/api/workspace/[^/]+/kanban/tasks$", "/api/workspace/{id}/kanban/tasks", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_kanban_tasks"),
+    ("POST", r"^/api/workspace/[^/]+/delegation-grants$", "/api/workspace/{id}/delegation-grants", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_delegation_grants"),
+    ("POST", r"^/api/workspace/[^/]+/runtime-profiles/purge$", "/api/workspace/{id}/runtime-profiles/purge", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_runtime_profiles_purge"),
+    ("POST", r"^/api/workspace/[^/]+/memory$", "/api/workspace/{id}/memory", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_memory"),
+    ("POST", r"^/api/memory/[^/]+$", "/api/memory/{id}", AuthLevel.SESSION, False, False, "_route_pattern_post_memory"),
+    ("POST", r"^/api/workspace/[^/]+/budget$", "/api/workspace/{id}/budget", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_budget"),
+    ("POST", r"^/api/workspace/[^/]+/grants$", "/api/workspace/{id}/grants", AuthLevel.SESSION, False, False, "_route_pattern_post_workspace_grants"),
+    ("POST", r"^/api/hermes/profiles/[^/]+/bootstrap-dm$", "/api/hermes/profiles/{slug}/bootstrap-dm", AuthLevel.SESSION, False, False, "_route_pattern_post_hermes_profile_bootstrap_dm"),
+    ("POST", r"^/api/hermes/profiles/[^/]+/soul$", "/api/hermes/profiles/{slug}/soul", AuthLevel.SESSION, False, False, "_route_pattern_post_hermes_profile_soul"),
+    ("POST", r"^/api/hermes/profiles/[^/]+/bind$", "/api/hermes/profiles/{slug}/bind", AuthLevel.SESSION, False, False, "_route_pattern_post_hermes_profile_bind"),
+    ("POST", r"^/api/hermes/profiles/[^/]+/sessions$", "/api/hermes/profiles/{slug}/sessions", AuthLevel.SESSION, False, False, "_route_pattern_post_hermes_profile_sessions"),
+    ("POST", r"^/api/hermes/profiles/[^/]+/messages$", "/api/hermes/profiles/{slug}/messages", AuthLevel.SESSION, False, False, "_route_pattern_post_hermes_profile_messages"),
+    ("POST", r"^/api/hermes/profiles/[^/]+/messages/stream$", "/api/hermes/profiles/{slug}/messages/stream", AuthLevel.SESSION, False, False, "_route_pattern_post_hermes_profile_messages_stream"),
+    ("PATCH", r"^/api/hermes/profiles/[^/]+$", "/api/hermes/profiles/{slug}", AuthLevel.SESSION, False, False, "_route_pattern_patch_hermes_profile"),
+    ("PATCH", r"^/api/rooms/[^/]+$", "/api/rooms/{id}", AuthLevel.SESSION, False, False, "_route_pattern_patch_room"),
+    ("PATCH", r"^/api/workspace/[^/]+/integrations$", "/api/workspace/{id}/integrations", AuthLevel.SESSION, False, False, "_route_pattern_patch_workspace_integrations"),
+    ("PATCH", r"^/api/workspace/[^/]+/members$", "/api/workspace/{id}/members", AuthLevel.SESSION, False, False, "_route_pattern_patch_workspace_members"),
+    ("PATCH", r"^/api/workspace/[^/]+$", "/api/workspace/{id}", AuthLevel.SESSION, False, False, "_route_pattern_patch_workspace"),
+    ("DELETE", r"^/api/rooms/[^/]+$", "/api/rooms/{id}", AuthLevel.SESSION, False, False, "_route_pattern_delete_room"),
+    ("DELETE", r"^/api/memory/[^/]+$", "/api/memory/{id}", AuthLevel.SESSION, False, False, "_route_pattern_delete_memory"),
+    ("DELETE", r"^/api/workspace/[^/]+/members$", "/api/workspace/{id}/members", AuthLevel.SESSION, False, False, "_route_pattern_delete_workspace_members"),
+    ("DELETE", r"^/api/me/credentials/[^/]+$", "/api/me/credentials/{provider}", AuthLevel.SESSION, False, False, "_route_pattern_delete_me_credentials"),
+)
+
+
+def _coerce_pattern_row(row: tuple) -> tuple[str, str, str, AuthLevel, bool, bool, str | None]:
+    if len(row) >= 7:
+        return row[:7]  # type: ignore[return-value]
+    m, rx, label, auth, sl, iw = row
+    return (m, rx, label, auth, sl, iw, None)
+
+
+ROUTE_PATTERNS: tuple[RoutePattern, ...] = tuple(
+    RoutePattern(
+        method=m,
+        pattern=re.compile(rx),
+        label=label,
+        auth=auth,
+        sessionless_ok=sl,
+        install_window=iw,
+        handler=h,
+    )
+    for m, rx, label, auth, sl, iw, h in (_coerce_pattern_row(r) for r in _ROUTE_PATTERNS_RAW)
 )
 
 _ROUTES_BY_METHOD_PATH: dict[tuple[str, str], Route] = {
     (r.method.upper(), r.path): r for r in ROUTES
 }
 
-
-INSTALL_ROUTE_METHODS: dict[str, frozenset[str]] = {
-    "GET": frozenset({
-        "/api/install/publish-hints",
-        "/api/install/url/test",
-    }),
-    "PATCH": frozenset({"/api/install/stack"}),
-    "POST": frozenset({
-        "/api/install/email/test",
-        "/api/install/complete",
-        "/api/install/url/test",
-        "/api/install/setup-https",
-    }),
+_DISPATCH_ROUTES: dict[tuple[str, str], Route] = {
+    (r.method.upper(), r.path): r for r in ROUTES if r.handler
 }
 
 
-def resolve_auth_level(method: str, path: str) -> AuthLevel:
-    """Map HTTP method + path to required auth level. All /api/* paths are covered."""
+@dataclass(frozen=True, slots=True)
+class AuthSpec:
+    auth: AuthLevel
+    sessionless_ok: bool = False
+    install_window: bool = False
+
+
+def lookup_auth(method: str, path: str) -> AuthSpec | None:
+    """Return auth spec for a registered /api/* route, or None when unregistered."""
     m = str(method or "GET").upper()
     p = str(path or "").strip()
-    if m == "GET" and p == "/api/auth/hermes-dashboard-gate":
-        return AuthLevel.PUBLIC
-    if m == "GET" and p in GET_ALWAYS_PUBLIC_ROUTES:
-        return AuthLevel.PUBLIC
+    if not p.startswith("/api/"):
+        return None
+    exact = _ROUTES_BY_METHOD_PATH.get((m, p))
+    if exact:
+        return AuthSpec(exact.auth, sessionless_ok=exact.sessionless_ok, install_window=exact.install_window)
+    for rp in ROUTE_PATTERNS:
+        if rp.method == m and rp.pattern.fullmatch(p):
+            return AuthSpec(rp.auth, sessionless_ok=rp.sessionless_ok, install_window=rp.install_window)
     if p.startswith("/api/public/"):
-        return AuthLevel.PUBLIC
-    if m == "GET" and p in GET_SINGLE_USER_PUBLIC_ROUTES:
-        return AuthLevel.SINGLE_USER_GET
-    if m == "POST" and p in AUTH_FLOW_POST_ROUTES:
-        return AuthLevel.AUTH_FLOW
-    if p in INSTALL_ROUTE_METHODS.get(m, frozenset()):
-        return AuthLevel.INSTALL
-    if m == "GET" and p == "/api/install/stack":
-        return AuthLevel.INSTALL
-    if p.startswith("/api/"):
-        return AuthLevel.SESSION
-    return AuthLevel.PUBLIC
+        return AuthSpec(AuthLevel.PUBLIC)
+    if p.startswith("/internal/"):
+        return AuthSpec(AuthLevel.INTERNAL)
+    return None
+
+
+def resolve_auth_level(method: str, path: str) -> AuthLevel | None:
+    """Map HTTP method + path to required auth level. None = unregistered /api/* (404 at dispatch)."""
+    spec = lookup_auth(method, path)
+    return spec.auth if spec else None
 
 
 def deployment_allows_sessionless_data_get(
@@ -199,13 +299,15 @@ def sessionless_get_allowed(
     deployment_mode: str,
     dev_local_unsafe: bool = False,
 ) -> bool:
-    level = resolve_auth_level("GET", path)
-    if level == AuthLevel.PUBLIC:
+    spec = lookup_auth("GET", path)
+    if spec is None:
+        return False
+    if spec.auth == AuthLevel.PUBLIC:
+        return True
+    if spec.sessionless_ok and deployment_allows_sessionless_data_get(
+        deployment_mode, dev_local_unsafe=dev_local_unsafe,
+    ):
         return True
-    if level == AuthLevel.SINGLE_USER_GET:
-        return deployment_allows_sessionless_data_get(
-            deployment_mode, dev_local_unsafe=dev_local_unsafe,
-        )
     return False
 
 
@@ -219,32 +321,53 @@ def authorize_request(
     install_window_open: bool,
     validate_session,
     attach_user,
+    get_workspace_role=None,
 ) -> bool:
-    """Return True when the request may proceed to the handler."""
+    """Return True when the request may proceed. Unregistered /api/* passes (404 later)."""
     m = str(method or "GET").upper()
+    p = str(path or "").strip()
+
     if dev_local_unsafe:
-        if session_id:
-            info = validate_session(session_id)
+        sid = str(session_id or "").strip()
+        if sid:
+            info = validate_session(sid)
             if info:
                 attach_user(info["user_id"])
         return True
     if m == "OPTIONS":
         return True
+    if not p.startswith("/api/"):
+        return True
+
+    spec = lookup_auth(m, p)
+    if spec is None:
+        return True
 
-    level = resolve_auth_level(m, path)
     sid = str(session_id or "").strip()
 
+    if spec.install_window and install_window_open:
+        if sid:
+            info = validate_session(sid)
+            if info:
+                attach_user(info["user_id"])
+        return True
+
+    level = spec.auth
+
     if level == AuthLevel.PUBLIC:
+        if spec.install_window and not install_window_open:
+            return False
         if sid:
             info = validate_session(sid)
             if info:
                 attach_user(info["user_id"])
         return True
 
-    if level == AuthLevel.SINGLE_USER_GET:
-        if m != "GET":
-            return _require_session(sid, validate_session, attach_user)
-        if deployment_allows_sessionless_data_get(
+    if level == AuthLevel.INTERNAL:
+        return True
+
+    if level == AuthLevel.SESSION:
+        if m == "GET" and spec.sessionless_ok and deployment_allows_sessionless_data_get(
             deployment_mode, dev_local_unsafe=dev_local_unsafe,
         ):
             if sid:
@@ -254,32 +377,25 @@ def authorize_request(
             return True
         return _require_session(sid, validate_session, attach_user)
 
-    if level == AuthLevel.AUTH_FLOW:
-        return True
-
-    if level == AuthLevel.INSTALL:
-        if not install_window_open:
+    if level == AuthLevel.ROLE_OWNER_ADMIN:
+        if not _require_session(sid, validate_session, attach_user):
             return False
-        if sid:
-            info = validate_session(sid)
-            if info:
-                attach_user(info["user_id"])
-        return True
-
-    if level == AuthLevel.SESSION:
-        return _require_session(sid, validate_session, attach_user)
+        role = ""
+        if callable(get_workspace_role):
+            role = str(get_workspace_role() or "").strip().lower()
+        return role in {"owner", "admin"}
 
     return False
 
 
 def lookup_route(method: str, path: str) -> Route | None:
-    return _ROUTES_BY_METHOD_PATH.get((str(method or "GET").upper(), str(path or "").strip()))
+    return _DISPATCH_ROUTES.get((str(method or "GET").upper(), str(path or "").strip()))
 
 
 def dispatch_get(handler: Any, path: str, qs: dict[str, list[str]]) -> bool:
     """Invoke a registered GET handler on *handler*; return True when dispatched."""
     route = lookup_route("GET", path)
-    if not route:
+    if not route or not route.handler:
         return False
     fn = getattr(handler, route.handler, None)
     if not callable(fn):
@@ -291,7 +407,7 @@ def dispatch_get(handler: Any, path: str, qs: dict[str, list[str]]) -> bool:
 def dispatch_post(handler: Any, path: str, body: dict) -> bool:
     """Invoke a registered POST handler on *handler*; return True when dispatched."""
     route = lookup_route("POST", path)
-    if not route:
+    if not route or not route.handler:
         return False
     fn = getattr(handler, route.handler, None)
     if not callable(fn):
@@ -300,6 +416,42 @@ def dispatch_post(handler: Any, path: str, body: dict) -> bool:
     return True
 
 
+def dispatch_patch(handler: Any, path: str, body: dict) -> bool:
+    """Invoke a registered PATCH handler on *handler*; return True when dispatched."""
+    route = lookup_route("PATCH", path)
+    if not route or not route.handler:
+        return False
+    fn = getattr(handler, route.handler, None)
+    if not callable(fn):
+        raise RuntimeError(f"missing handler {route.handler!r} for PATCH {path}")
+    fn(body)
+    return True
+
+
+def dispatch_pattern(
+    method: str,
+    handler: Any,
+    path: str,
+    *,
+    qs: dict[str, list[str]] | None = None,
+    body: dict | None = None,
+) -> bool:
+    """Invoke a pattern-backed handler; return True when dispatched."""
+    m = str(method or "GET").upper()
+    for rp in ROUTE_PATTERNS:
+        if rp.method != m or not rp.handler or not rp.pattern.fullmatch(path):
+            continue
+        fn = getattr(handler, rp.handler, None)
+        if not callable(fn):
+            raise RuntimeError(f"missing handler {rp.handler!r} for {m} {path}")
+        if m == "GET":
+            fn(path, qs or {})
+        else:
+            fn(path, body or {})
+        return True
+    return False
+
+
 def _require_session(sid: str, validate_session, attach_user) -> bool:
     if not sid:
         return False
@@ -313,18 +465,6 @@ def _require_session(sid: str, validate_session, attach_user) -> bool:
 def iter_registered_api_paths() -> frozenset[tuple[str, str]]:
     """Exact (method, path) pairs declared in the registry (for audit tests)."""
     out: set[tuple[str, str]] = set()
-    for p in GET_ALWAYS_PUBLIC_ROUTES:
-        out.add(("GET", p))
-    for p in GET_SINGLE_USER_PUBLIC_ROUTES:
-        out.add(("GET", p))
-    for p in AUTH_FLOW_POST_ROUTES:
-        out.add(("POST", p))
-    for m, paths in INSTALL_ROUTE_METHODS.items():
-        for p in paths:
-            out.add((m, p))
-    out.add(("GET", "/api/install/stack"))
-    out.add(("PATCH", "/api/install/stack"))
-    out.add(("GET", "/api/auth/hermes-dashboard-gate"))
     for route in ROUTES:
         out.add((route.method.upper(), route.path))
     return frozenset(out)