@lanes-sh/link 0.2.2 → 0.3.1

package/src/server/cors.ts

@@ -0,0 +1,252 @@
+import { isAuthorizationPath } from './oauth.ts';
+
+/**
+ * Cross-origin access, for a routable deployment and nothing else.
+ *
+ * A preflight carries no credentials, by construction rather than by omission:
+ * the CORS specification strips them, so `OPTIONS` arrives with no
+ * `Authorization` header and no cookie. Answering it from behind the bearer gate
+ * therefore refuses every browser-origin client *before* it has any opportunity
+ * to present one — which is what this endpoint did until this file existed, and
+ * it is a category error rather than a policy.
+ *
+ * **Never on loopback.** `./rebinding.ts` already answers that question, and
+ * answers it no: a cross-origin `Origin` on a request to `127.0.0.1` is refused
+ * outright, because a page the owner happens to be visiting can otherwise reach
+ * everything that answers before authentication — including the `/authorize`
+ * form that asks them for their token. A CORS grant and an `Origin` refusal on
+ * the same request are two answers to one question. So `serve` builds a policy
+ * only for a host that is not loopback, and nothing in this file decides that:
+ * it is decided by whether a policy exists at all.
+ */
+
+/**
+ * Two halves, because what is already public and what carries the credential
+ * differ in what a grant costs.
+ *
+ * The public half is the authorization surface: readable without a credential by
+ * design, so a wildcard adds no reach a `curl` did not already have. It includes
+ * `/authorize`, which needs no grant at all — a top-level navigation, not a
+ * fetch — because `isAuthorizationPath` is one predicate that already exists and
+ * a second list of five paths would be a second thing to drift.
+ *
+ * `/health` and `/reload` are in neither half. No browser client needs them, and
+ * where the answer is not obvious default deny is the cheaper mistake.
+ */
+export type CorsSurface = 'public' | 'credentialed';
+
+export interface CorsPolicy {
+  /**
+   * Origins that may call the credentialed surface. `['*']` is the default.
+   *
+   * A wildcard, and not because narrowing was too much work — because on a
+   * deployment there is nothing left for it to defend. Three things have to be
+   * true together, and here they are:
+   *
+   * 1. **The endpoint is already reachable by anyone.** `access: public` is what
+   *    a connector needs, so any server on the internet can post to `/mcp` and
+   *    read the refusal today. CORS never gated *sending*; it gates whether a
+   *    *page* may read the reply. An attacker with a server needs no page.
+   * 2. **The credential is never ambient.** It is an `Authorization` header a
+   *    page must already possess, never a cookie a browser attaches on its own.
+   *    So the request a hostile page gains is an unauthenticated one, and what
+   *    it gains from reading the answer is a `401` it could have had from
+   *    anywhere.
+   * 3. **`Access-Control-Allow-Credentials` is never sent** — and with `*` it
+   *    cannot be: the specification refuses the combination outright. The one
+   *    header that would make a wildcard dangerous is unreachable from here.
+   *
+   * What an allowlist bought, then, was a required setup step per user in
+   * exchange for narrowing a surface that was not exposed. Naming origins is
+   * still possible and still narrows — an enterprise deployment may want it —
+   * but absent means `*`, because a default nobody can skip is a default that
+   * is wrong.
+   *
+   * None of this holds on loopback, which is why loopback has no policy at all.
+   * There the endpoint is *not* publicly reachable, and that is precisely what
+   * a page reaching `127.0.0.1` would be stealing.
+   */
+  readonly allowedOrigins: readonly string[];
+}
+
+/** The default, and what an absent `auth.allowed_origins` resolves to. */
+export const ANY_ORIGIN = '*';
+
+/**
+ * What a browser is allowed to send.
+ *
+ * The list is fixed rather than reflected from `Access-Control-Request-Headers`,
+ * because reflecting it grants whatever was asked for and the answer to "which
+ * headers does this endpoint read" is knowable here. These are they: the
+ * credential, the 2026-07-28 envelope's method and target, the client label the
+ * audit log records, and the session and resumption headers the MCP SDK sends.
+ */
+const ALLOW_HEADERS = [
+  'authorization',
+  'content-type',
+  'mcp-session-id',
+  'mcp-protocol-version',
+  'mcp-method',
+  'mcp-name',
+  'x-mcp-client',
+  'last-event-id',
+].join(', ');
+
+/**
+ * What a browser is allowed to read back.
+ *
+ * `WWW-Authenticate` is the load-bearing one: it carries `resource_metadata`,
+ * which is the whole discovery handshake (ADR-036). Without it a browser client
+ * receives the `401` and cannot see the pointer that tells it what to do next,
+ * which looks exactly like an endpoint that refuses for no reason.
+ *
+ * `Retry-After` for the same reason on the other refusal — `edge.ts` sends one
+ * with a `429` and a caller that cannot read it can only guess when to retry.
+ */
+const EXPOSE_HEADERS = ['WWW-Authenticate', 'Mcp-Session-Id', 'Retry-After'].join(', ');
+
+/**
+ * Which half a path belongs to, or neither.
+ *
+ * The authorization surface answers without a credential by design, so a
+ * wildcard there hands a page what `curl` already has. Everything else is either
+ * named by the caller as credentialed or gets nothing at all.
+ */
+function surfaceOf(pathname: string, credentialed: readonly string[]): CorsSurface | undefined {
+  if (isAuthorizationPath(pathname)) return 'public';
+  return credentialed.includes(pathname) ? 'credentialed' : undefined;
+}
+
+/** POST for calls, GET for the SSE stream, DELETE to end a session. */
+const ALLOW_METHODS = 'GET, POST, DELETE, OPTIONS';
+
+/** A day. A preflight per call is the cost of getting this wrong. */
+const MAX_AGE = '86400';
+
+/**
+ * The value for `Access-Control-Allow-Origin`, or `null` to grant nothing.
+ *
+ * A listed origin is echoed rather than answered with `*`, because a list is a
+ * narrowing and `*` would discard it. That is also why the wildcard and the echo
+ * cannot share a branch: they differ in whether the answer varies by caller, and
+ * `Vary` has to follow.
+ */
+function grantFor(request: Request, surface: CorsSurface, policy: CorsPolicy): string | null {
+  if (surface === 'public') return ANY_ORIGIN;
+  if (policy.allowedOrigins.includes(ANY_ORIGIN)) return ANY_ORIGIN;
+
+  const origin = request.headers.get('origin');
+  return origin && policy.allowedOrigins.includes(origin) ? origin : null;
+}
+
+/**
+ * The headers to add to a response, or `undefined` for nothing to add.
+ *
+ * Nothing is added when the request carries no `Origin`, which is every
+ * non-browser client: there is no origin to grant, and a header naming one
+ * would be an invention. That is also what keeps `curl` output identical to what
+ * it was.
+ */
+function corsHeaders(
+  request: Request,
+  surface: CorsSurface,
+  policy: CorsPolicy,
+): Record<string, string> | undefined {
+  const origin = request.headers.get('origin');
+  if (!origin) return undefined;
+
+  const allowed = grantFor(request, surface, policy);
+  if (!allowed) return undefined;
+
+  return {
+    'access-control-allow-origin': allowed,
+    'access-control-allow-methods': ALLOW_METHODS,
+    'access-control-allow-headers': ALLOW_HEADERS,
+    'access-control-expose-headers': EXPOSE_HEADERS,
+    'access-control-max-age': MAX_AGE,
+    // Only meaningful where the value varies, and harmful to omit there: a
+    // shared cache would otherwise hand one origin's grant to another.
+    ...(allowed === ANY_ORIGIN ? {} : { vary: 'Origin' }),
+  };
+}
+
+/**
+ * The answer to a preflight: `204`, with the grant or without it.
+ *
+ * Without it for an origin that is not allowed, rather than a `403` — the
+ * browser refuses the call on the absence of the header, which is the mechanism
+ * CORS actually uses, and a distinct status would tell a probing page which
+ * paths exist. Never a `401`: see the note at the top of this file.
+ *
+ * `Access-Control-Allow-Credentials` is absent from both, deliberately and
+ * everywhere. The credential here is a header a page cannot obtain, never a
+ * cookie a browser would attach on its own, so the wildcard above grants
+ * nothing without it — and sending it is what would turn that wildcard into a
+ * hole.
+ */
+function preflightResponse(headers: Record<string, string> | undefined): Response {
+  return new Response(null, { status: 204, headers: headers ?? {} });
+}
+
+/**
+ * The same response, carrying the grant.
+ *
+ * Rebuilt rather than mutated: a `Response` the MCP SDK returns may carry an
+ * immutable header guard, and `body` is a stream that survives being passed
+ * through. A `204` or `304` has a null body already, so this is safe for those
+ * too.
+ */
+function withCors(response: Response, headers: Record<string, string>): Response {
+  const merged = new Headers(response.headers);
+  for (const [name, value] of Object.entries(headers)) merged.set(name, value);
+
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: merged,
+  });
+}
+
+/**
+ * The same handler, with cross-origin requests answered.
+ *
+ * A wrapper rather than six branches in the router, for the reason `./oauth.ts`
+ * is its own file: `index.ts` gains a delegation instead of the whole of this
+ * behaviour, and it stays inside the size budget that would otherwise be the
+ * rule relaxed to fit this in.
+ *
+ * Wrapped at `serve()` rather than inside the router, which is also where the
+ * policy is decided: cross-origin access is a property of the address this is
+ * bound to, exactly as `allowedHostnames` and the dashboard are, and putting all
+ * three in one function is what makes the loopback exclusion legible instead of
+ * an invariant spread across two files.
+ *
+ * It is what makes the ordering safe, too. A preflight answered here never
+ * reaches the rebinding guard inside `inner` — and does not need to, because a
+ * policy exists only off loopback, where that guard is inert. Both facts are
+ * three lines apart in `serve()`, derived from the same `loopback`.
+ *
+ * The credentialed paths are passed rather than imported because the router owns
+ * its own path constants, and reaching back for `MCP_PATH` would make this file
+ * and that one import each other.
+ */
+export function corsAware(
+  inner: (request: Request) => Promise<Response>,
+  credentialed: readonly string[],
+  policy: CorsPolicy,
+): (request: Request) => Promise<Response> {
+  return async (request) => {
+    const surface = surfaceOf(new URL(request.url).pathname, credentialed);
+    if (!surface) return await inner(request);
+
+    const headers = corsHeaders(request, surface, policy);
+
+    // Answered here, ahead of the auth gate, because a preflight carries no
+    // credential and never will — the note at the top of this file says why that
+    // is a fact about CORS rather than a choice about this endpoint.
+    if (request.method === 'OPTIONS') return preflightResponse(headers);
+
+    const response = await inner(request);
+    return headers ? withCors(response, headers) : response;
+  };
+}

package/src/server/dashboard.ts

@@ -0,0 +1,208 @@
+import type { Authenticator } from '#auth';
+import { dashboardPage, dashboardSignInPage, type DashboardConnection } from '#cli/dashboard-page.ts';
+import type { Generations } from './generations.ts';
+
+/**
+ * The dashboard route.
+ *
+ * Local only, and mounted by nobody else: `lanes link start` asks for it and the
+ * container entrypoint does not, with `serve()` refusing it a second time if the
+ * bind address is not loopback. That is a decision rather than an omission, and
+ * ADR-018 is why. Cloud Run IAM admits a caller holding a Google-signed identity
+ * token; a browser doing a top-level navigation never sends one, so `access:
+ * iam` answers a person with a 403 rather than a sign-in page. The mode a remote
+ * client actually uses — `access: public` with an `auth.authorization` block —
+ * leaves the front door open and gates `/mcp` on a bearer token instead, which a
+ * navigation cannot carry either. Neither arrangement has a browser-shaped door,
+ * so this one does not pretend to be reachable through them.
+ *
+ * What it serves is a reader. Nothing here writes config, authorises anything,
+ * or reaches an upstream — see `#cli/dashboard-page.ts` for why that is the
+ * honest shape rather than a limitation to lift later.
+ */
+
+export const DASHBOARD_PATH = '/dashboard';
+
+/**
+ * Whether a bind serves the dashboard.
+ *
+ * Two conditions, and both are load-bearing. Asking is the entrypoint's
+ * decision — `lanes link start` does, the container does not. Loopback is the
+ * one that does not depend on anybody remembering: a routable bind is a
+ * deployed one, and the consequence of getting this wrong is a page listing the
+ * owner's accounts on a public address. Named rather than inlined so the rule
+ * can be stated once and asserted directly.
+ */
+export function servesDashboard(asked: boolean | undefined, loopback: boolean): boolean {
+  return asked === true && loopback;
+}
+
+/** The query parameter `lanes link dashboard` puts the profile token in. */
+const KEY_PARAM = 'k';
+
+const COOKIE = 'lanes_link_dashboard';
+
+/**
+ * How long a browser stays signed in.
+ *
+ * Bounded rather than tied to the process: an endpoint left running for weeks
+ * should not leave a tab that authenticated once able to read the workspace for
+ * as long as it lives.
+ */
+const SESSION_MS = 12 * 60 * 60 * 1000;
+
+/**
+ * Sessions this handler has issued.
+ *
+ * A random id, not the profile token. The token arrives once, in a URL the CLI
+ * built, and is exchanged here for something that is worth nothing anywhere else
+ * — so the credential that reaches every profile is never sitting in a cookie
+ * jar, and revoking it is closing this process rather than clearing a browser.
+ *
+ * In memory, which is the one place stateless-by-design does not apply: this
+ * route exists only on a single local process. The deployed instance that
+ * `index.ts` keeps stateless for never serves it.
+ */
+export interface DashboardSessions {
+  issue(): string;
+  valid(id: string | null): boolean;
+}
+
+export function dashboardSessions(now: () => number = Date.now): DashboardSessions {
+  const issued = new Map<string, number>();
+
+  return {
+    issue() {
+      const id = crypto.randomUUID();
+      const at = now();
+      // Pruned on write rather than on a timer, so an endpoint nobody is
+      // looking at holds nothing and runs nothing.
+      for (const [key, expires] of issued) if (expires <= at) issued.delete(key);
+      issued.set(id, at + SESSION_MS);
+      return id;
+    },
+    valid(id) {
+      if (!id) return false;
+      const expires = issued.get(id);
+      if (expires === undefined) return false;
+      if (expires <= now()) {
+        issued.delete(id);
+        return false;
+      }
+      return true;
+    },
+  };
+}
+
+export interface DashboardSurface {
+  readonly generations: Generations;
+  readonly authenticator: Authenticator;
+  /** The profile shown when the URL names none. */
+  readonly primary: string;
+  readonly sessions: DashboardSessions;
+}
+
+function cookieValue(header: string | null, name: string): string | null {
+  if (!header) return null;
+  for (const part of header.split(';')) {
+    const [key, ...rest] = part.trim().split('=');
+    if (key === name) return rest.join('=');
+  }
+  return null;
+}
+
+export async function handleDashboard(
+  request: Request,
+  surface: DashboardSurface,
+): Promise<Response> {
+  if (request.method !== 'GET' && request.method !== 'HEAD') {
+    return new Response('Method not allowed', { status: 405, headers: { allow: 'GET, HEAD' } });
+  }
+
+  const url = new URL(request.url);
+  const key = url.searchParams.get(KEY_PARAM);
+
+  if (key !== null) {
+    // The token is checked by the same authenticator every other route uses,
+    // rather than compared here. One credential, one comparison, one place a
+    // rotation has to land.
+    const outcome = await surface.authenticator.authenticate(`Bearer ${key}`);
+    if (!outcome.ok) return dashboardSignInPage(401);
+
+    // Straight back out to a URL without it. A token that stays in the address
+    // bar is one in the history, in the window title, and in whatever the next
+    // link sends as a Referer — and this is the only request that needs it.
+    url.searchParams.delete(KEY_PARAM);
+    return new Response(null, {
+      status: 303,
+      headers: {
+        location: `${url.pathname}${url.search}`,
+        // No `Secure`: this is served over http on loopback and nowhere else,
+        // and a Secure cookie would simply never be stored. `SameSite=Strict`
+        // is what keeps another origin from navigating into an authenticated
+        // view, and the rebinding check in front of every route (`index.ts`)
+        // is what keeps one from being the origin in the first place.
+        'set-cookie':
+          `${COOKIE}=${surface.sessions.issue()}; HttpOnly; SameSite=Strict; ` +
+          `Path=${DASHBOARD_PATH}; Max-Age=${Math.floor(SESSION_MS / 1000)}`,
+        'cache-control': 'no-store',
+      },
+    });
+  }
+
+  if (!surface.sessions.valid(cookieValue(request.headers.get('cookie'), COOKIE))) {
+    return dashboardSignInPage(401);
+  }
+
+  // Pinned for the whole render, as a request on `/mcp` is: a reload landing
+  // between the connection list and the provider catalogue would otherwise
+  // produce a page describing two different configurations.
+  const generation = surface.generations.acquire();
+  try {
+    const asked = url.searchParams.get('profile');
+    const name = asked ?? surface.primary;
+    const runtime = generation.profiles.get(name);
+
+    // A name this endpoint does not serve can only have been typed: every
+    // profile link on the page comes from the list below. Refusing beats
+    // rendering a different profile than the URL says, which is the silent pick
+    // `resolveSelection` exists to prevent.
+    if (!runtime) return new Response('Not found', { status: 404 });
+
+    const records = runtime.connections ? await runtime.connections() : [];
+    const byKey = new Map(records.map((record) => [`${record.provider}.${record.id}`, record]));
+
+    // The same join `lanes link status` makes: config says what should exist,
+    // the store says what does, and the difference is the whole point of
+    // showing it.
+    const connections: DashboardConnection[] = runtime.config.connections.map((connection) => ({
+      key: `${connection.provider}.${connection.id}`,
+      provider: connection.provider,
+      account: connection.account,
+      state: byKey.get(`${connection.provider}.${connection.id}`)?.status ?? 'not reconciled',
+    }));
+
+    // Never `instance.default_target`, which this line used to fall back to.
+    // ADR-037 left that field inert precisely so a missing target surfaces here
+    // rather than one command later: the page names a credential store, and a
+    // page that guessed which one would report an account as connected against
+    // a store the endpoint asking for it does not read.
+    //
+    // Absent only if a runtime reached this route without being opened against
+    // anything, which a served endpoint never does — `endpoint.ts` builds every
+    // entry in that map from a `Runtime`, whose target is required. Refusing
+    // beats rendering, for the same reason the 404 above does.
+    if (!runtime.target) return new Response('No target', { status: 500 });
+
+    return dashboardPage({
+      profile: name,
+      profiles: generation.names(),
+      target: runtime.target,
+      targets: Object.keys(runtime.config.targets),
+      connections,
+      ownClients: Object.keys(runtime.config.oauth_apps),
+    });
+  } finally {
+    await surface.generations.release(generation);
+  }
+}

package/src/server/endpoint.ts

@@ -47,10 +47,22 @@ export interface EndpointReporter {
   reconciled(input: { profile: string; plan: string; ofMany: boolean }): void;
   /** No profile token existed and one was minted. */
   tokenMinted(minted: { target: string }): void;
+  /**
+   * A sibling profile that could not be opened against this target.
+   *
+   * Optional because it is new and every caller predates it, and because
+   * silence is a defensible reading for a caller that only wants what it got.
+   */
+  skipped?(input: { profile: string; reason: string }): void;
 }
 
 const SILENT: EndpointReporter = { reconciled() {}, tokenMinted() {} };
 
+/** The first line of an error, which is the part fit to print beside a name. */
+function message(error: unknown): string {
+  return error instanceof Error ? (error.message.split('\n')[0] ?? error.message) : String(error);
+}
+
 export interface EndpointOptions {
   readonly flags: GlobalFlags;
   readonly port?: number | undefined;
@@ -65,6 +77,16 @@ export interface EndpointOptions {
   readonly reporter?: EndpointReporter | undefined;
   /** Operational events. Silent when absent, which is what the tests want. */
   readonly log?: Logger | undefined;
+  /**
+   * Serve the dashboard at `/dashboard`.
+   *
+   * True for `lanes link start`, absent in a container — the same split as
+   * `mintToken`, and for a related reason. A deployed instance has no door a
+   * browser can come through (ADR-018), so a page there would be either
+   * unreachable or unguarded depending on `deploy.access`, and both are worse
+   * than not having one.
+   */
+  readonly dashboard?: boolean | undefined;
 }
 
 export interface RunningEndpoint {
@@ -103,7 +125,22 @@ async function openReconciled(options: {
   try {
     for (const name of names) {
       if (runtimes.has(name)) continue;
-      runtimes.set(name, await openRuntime({ ...options.flags, profile: name }));
+
+      // A sibling that does not declare this target is skipped, not fatal.
+      //
+      // Every profile here is opened against the one target the endpoint was
+      // started with, and a workspace may hold a profile that runs somewhere
+      // else entirely. Refusing would let one such profile take the endpoint
+      // down for all of them, which is the opposite of what `start` is for —
+      // and in a container it is a revision that never goes healthy. Skipping
+      // is not an assumption: it is reported, and `served` below is derived
+      // from what actually opened rather than from what is on disk.
+      try {
+        runtimes.set(name, await openRuntime({ ...options.flags, profile: name }));
+      } catch (error) {
+        if (name === primary.resolution.profile) throw error;
+        reporter.skipped?.({ profile: name, reason: message(error) });
+      }
     }
 
     for (const [name, runtime] of runtimes) {
@@ -147,6 +184,12 @@ function profileRuntimes(runtimes: ReadonlyMap<string, Runtime>): Map<string, Pr
         // through `skills.manage.write`, or by `lanes link skills add` in another
         // terminal — is a prompt without a restart (ADR-014).
         refreshSkills: runtime.refreshSkills,
+        // For a surface that reports rather than dispatches. A thunk rather
+        // than a snapshot because a reconcile lands between requests, and the
+        // dashboard reading a list captured at boot would keep showing an
+        // account as unauthorized after the connect that fixed it.
+        target: runtime.target,
+        connections: () => runtime.state.connections.list(),
       },
     ]),
   );
@@ -293,6 +336,7 @@ export async function startEndpoint(options: EndpointOptions): Promise<RunningEn
         : primary.authenticator,
       log,
       ...(gate ? { authorization: gate.surface } : {}),
+      ...(options.dashboard ? { dashboard: true } : {}),
       ...(options.port !== undefined ? { port: options.port } : {}),
       ...(options.host !== undefined ? { host: options.host } : {}),
     });

package/src/server/generations.ts

@@ -1,5 +1,5 @@
 import type { Logger } from '#connectivity';
-import { clearUpstreamTokens } from '#connectivity/auth/index.ts';
+import { clearMintedTokens, clearUpstreamTokens } from '#connectivity/auth/index.ts';
 import type { ProfileRuntime } from '#server/mcp';
 import { Generation } from './generation.ts';
 
@@ -184,12 +184,21 @@ export class Generations {
     // cloud target is a network write, so this is reachable rather than
     // theoretical.
     try {
-      // Module-global and keyed per connection, so it survives a reload that
+      // Module-global and keyed per connection, so they survive a reload that
       // replaced everything else. Re-connecting `<provider>.<id>` to a different
       // account would otherwise serve the previous account's access token until
       // it expired — up to an hour after the config said otherwise. Unchanged
       // connections pay one refresh.
+      //
+      // Both caches, because a connection authenticates one way at a time and
+      // re-connecting is how it changes: the route is settled by what `connect`
+      // last stored, so a reload that cleared only the authorization-code cache
+      // would keep serving a token minted from a key for a connection that no
+      // longer authenticates with one — and, worse, keep acting as the
+      // previously impersonated user, since the minted cache is keyed by
+      // connection with no subject in it.
       clearUpstreamTokens();
+      clearMintedTokens();
 
       // After the swap: a request arriving during the retire already gets the
       // new generation, and this only waits on requests that started before it.

package/src/server/harness.ts

@@ -121,6 +121,8 @@ export interface HarnessOptions {
    * serving the old generation" case is reached; absent means nothing new.
    */
   reopen?: () => Promise<ReadonlyMap<string, ProfileRuntime>>;
+  /** Serve `/dashboard`, as `lanes link start` does and a container never does. */
+  dashboard?: boolean;
 }
 
 /**
@@ -181,6 +183,10 @@ export function wireProfiles(options: HarnessOptions): WiredProfiles {
       dispatcher,
       policy,
       ...(options.refreshSkills ? { refreshSkills: () => options.refreshSkills!(registry) } : {}),
+      // As `profileRuntimes` supplies them for real. A harness that claims to
+      // be the real wiring and omits a field leaves that field untested.
+      target: 'local',
+      connections: () => state.connections.list(),
     }),
   );
 
@@ -259,6 +265,7 @@ export function startHarness(options: HarnessOptions): Harness {
     primary: options.profile,
     authenticator: gate ? new AuthenticatorChain([bearer, gate.authenticator]) : bearer,
     ...(gate ? { authorization: gate.surface } : {}),
+    ...(options.dashboard ? { dashboard: true } : {}),
     log,
   });