toolroll 0.9.48 → 0.9.49

package/dist/serve.js

@@ -127,8 +127,8 @@ import { projectAuthority } from "./project-access.js";
  * centralized gate — `authorizeMutation` — that proves content type, an
  * allowed Origin, and the per-session CSRF nonce, and refuses duplicated
  * security fields; a mutation route cannot forget a check it never wrote.
- * Bearer mutations carry no cookie for a hostile page to ride, so they skip
- * the cookie ceremony and nothing else.
+ * Bearer mutations carry no cookie for a hostile page to ride, so they skip CSRF.
+ * Step-up ceremonies still require a cookie session; repeating a bearer password cannot approve.
  *
  * **Approval is step-up.** A session alone never approves a scope: the
  * approval form restates the goal, the exclusions, and the touches — the
@@ -268,9 +268,10 @@ import { targetOf } from "./monitoring.js";
 import { SSO_CSS, ssoSettingsHtml } from "./sso-ui.js";
 import { mintApiToken, parseApiToken, secretMatches, TOKEN_DAYS, tokenLive, tokenProjects } from "./api-tokens.js";
 import { createMcpHttp } from "./mcp-http.js";
-import { FLUSH_MS as REQUEST_BUDGET_FLUSH_MS, parseLimit, PER_DAY_MAX as REQUEST_BUDGET_PER_DAY_MAX, PER_MINUTE_MAX as REQUEST_BUDGET_PER_MINUTE_MAX, RequestBudget, setLimitOverride } from "./request-budget.js";
+import { FLUSH_MS as REQUEST_BUDGET_FLUSH_MS, limitWords, parseLimit, PER_DAY_MAX as REQUEST_BUDGET_PER_DAY_MAX, PER_MINUTE_MAX as REQUEST_BUDGET_PER_MINUTE_MAX, RequestBudget, setLimitOverride, SOURCE_BUDGET_DEFAULTS, SourceAdmission } from "./request-budget.js";
+import { REMOTE_MESSAGES, reproveRemote } from "./operate-remote.js";
 import { hstsFor, LOOPBACK_PEERS, plainHttpRefusal, transportOf } from "./public-access.js";
-import { createOAuthHttp, oauthTokenAllowed, resourceMetadataUrl } from "./mcp-oauth.js";
+import { createOAuthHttp, oauthProjects, oauthTokenAllowed, resourceMetadataUrl } from "./mcp-oauth.js";
 import { CREDENTIALS_CSS, credentialsHtml, tokenShownHtml } from "./credentials-ui.js";
 import { REQUEST_LIMITS_CSS, requestLimitsHtml, tokenLimitWords } from "./request-budget-ui.js";
 import { PEOPLE_AUDIT_CSS, personAuditHtml, personHref } from "./people-audit-ui.js";
@@ -568,7 +569,12 @@ export function createDecisionServer(options) {
      * access to the project) is checked either way.
      */
     // v100: the shared check honours a fresh identity-provider sign-in itself (freshIdentitySignIn, set per request below).
-    const authenticateApprover = checkApproverPassword;
+    function authenticateApprover(who, token, repo) {
+        // Re-entering a password never upgrades a machine credential into a browser ceremony.
+        if (who.via !== "cookie")
+            return { ok: false, reason: "not-an-approver" };
+        return checkApproverPassword(store, who.name, token, repo);
+    }
     const signInBudget = new SourceBudget();
     const ssoVisits = new Map();
     const ssoHandoffs = new Map();
@@ -782,17 +788,59 @@ export function createDecisionServer(options) {
                     return { ...summary, card: teamProposalCardParts(store, actor, proposal, snapshot, csrf, decision, clock(), teamChatProvider).card };
                 }) } };
     };
+    // v112: one request budget per server for person API tokens, shared by every route a token signs in at (request-budget.ts).
+    const requestBudget = new RequestBudget({ store, ...(options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock }) });
+    // Unproved password attempts share a source budget. Only successful proof spends an account budget.
+    const sourceClock = options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock };
+    const passwordSourceBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, ...sourceClock });
+    const passwordAccountBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.password, ...sourceClock });
+    const teamsSourceBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.teamsSource, ...sourceClock });
+    const teamsTenantBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.teamsTenant, ...sourceClock });
+    const oauthTokenBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.oauthToken, ...sourceClock });
+    const presentsPassword = (request) => /^Bearer (.+):(.+)$/.test(request.headers.authorization ?? "");
+    const admitPasswordSource = (request) => presentsPassword(request) ? passwordSourceBudget.admit(joinSourceOf(request)) : { ok: true };
+    /** Called only with a proved identity; cookies spend neither bearer budget. */
+    const admitBearer = (request, actor) => {
+        if (actor.principal !== undefined)
+            return requestBudget.admit(actor.principal.tokenId, "api");
+        return presentsPassword(request) ? passwordAccountBudget.admit(actor.name) : { ok: true };
+    };
+    /**
+     * The full principal a live `so_` API token stands for: its person and their generation, the token's own read/act
+     * scope, its project limit narrowed by the person's current access, and its id. Every route that accepts an API token
+     * builds its identity here and carries it whole, so no route can drop the token's narrower scope or projects.
+     */
+    const tokenPrincipalOf = (request) => {
+        const who = identify(request, false, true);
+        return who?.via === "bearer" ? who.principal ?? null : null;
+    };
+    const presentsToken = (request) => /^Bearer so_\S+$/.test(request.headers.authorization ?? "");
     const teamEndpoint = (request, response) => handleTeamHttp(request, response, {
         authenticate: request => {
+            if (presentsToken(request)) {
+                const principal = tokenPrincipalOf(request);
+                return principal === null ? null : { name: principal.account, generation: principal.generation, principal };
+            }
             const who = identify(request, request.method === 'POST');
             const account = who === null ? null : store.accountOf(who.name);
             return who && account && account.revokedAt === null ? { name: who.name, generation: account.generation } : null;
         },
+        admit: admitPasswordSource,
+        admitAuthenticated: admitBearer,
         revalidate: (request, actor) => {
             const account = store.accountOf(actor.name);
             if (!account || account.revokedAt !== null || account.generation !== actor.generation)
                 return false;
-            // Bearer was proved when this connection opened. Cookie expiry/revocation
+            // An API token is re-proved against the store every time: unrevoked, unexpired, inside its project limit.
+            if (actor.principal !== undefined) {
+                const live = reproveRemote(store, actor.principal, new Date());
+                if (!live.ok)
+                    return false;
+                // The post-body mutation check must see a scope lowered since authentication, too.
+                actor.principal = { ...actor.principal, scope: live.scope };
+                return true;
+            }
+            // A password bearer was proved when this connection opened. Cookie expiry/revocation
             // is rechecked without allowing a passive stream to extend its lifetime.
             if (request.headers.authorization)
                 return true;
@@ -800,6 +848,8 @@ export function createDecisionServer(options) {
             return who?.name === actor.name && who.via === 'cookie' && who.session.generation === actor.generation;
         },
         authorizeMutation: (request, actor) => {
+            if (actor.principal !== undefined)
+                return request.headers.origin === undefined;
             const who = identify(request, false);
             if (!who || who.name !== actor.name)
                 return false;
@@ -813,29 +863,22 @@ export function createDecisionServer(options) {
         },
         execute: async (actor, input) => {
             const reply = await team.execute(actor, input);
+            if (actor.principal !== undefined)
+                return reply;
             const who = identify(request, false);
             return who?.via === 'cookie' ? teamBrowserReply(reply, actor, who.session.csrf) : reply;
         }, cursor: team.cursor, streams: teamStreams,
     });
-    // v112: one request budget per server for person API tokens, shared by /api/cli and /mcp (request-budget.ts).
-    const requestBudget = new RequestBudget({ store, ...(options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock }) });
     // Remote CLI: one live API token names the person; the shared command boundary decides everything else.
     const cliEndpoint = (request, response) => handleCliHttp(request, response, {
         admit: principal => requestBudget.admit(principal.tokenId, "api"),
-        authenticate: request => {
-            const who = identify(request, false, true);
-            const id = parseApiToken(/^Bearer (so_\S+)$/.exec(request.headers.authorization ?? "")?.[1] ?? "")?.id;
-            const row = id === undefined ? undefined : store.apiTokenSecret(id)?.row;
-            const account = who === null ? null : store.accountOf(who.name);
-            if (who?.via !== "bearer" || who.token === undefined || row === undefined || row.account !== who.name || account === null || account.revokedAt !== null)
-                return null;
-            return { kind: "person", account: who.name, generation: account.generation, scope: row.access, tokenId: row.id, projects: tokenProjects(account.projects, row.projects) };
-        },
+        authenticate: tokenPrincipalOf,
         run: async () => options.cliRunner ?? (await import("./operate.js")).runOperateAs ?? null,
         modeOf: options.cliModeOf,
         store,
     });
-    const sessionEndpoint = createSessionEndpoint({ store, workspace: coding, projects: codingProjects, projectAllowed: repo => rowVisible(liveCeiling(), repo) });
+    const sessionEndpoint = createSessionEndpoint({ store, workspace: coding, projects: codingProjects, projectAllowed: repo => rowVisible(liveCeiling(), repo),
+        admit: admitPasswordSource, admitAuthenticated: admitBearer });
     /** The enumerable admission list for roll-up SQL: repos-only ceilings
      * enumerate themselves; root ceilings enumerate the STORED repos that
      * pass the ceiling (Codex roll-up review, finding 11); unscoped = null. */
@@ -945,8 +988,18 @@ export function createDecisionServer(options) {
      * it is a smuggling attempt.
      */
     function authorizeMutation(request, who, body) {
+        // A read token never mutates, whatever its person's role (operate-remote.ts says the same to the remote CLI).
+        if (who.via === "bearer") {
+            if (who.principal !== undefined) {
+                const live = reproveRemote(store, who.principal, new Date());
+                if (!live.ok)
+                    return { status: 403, message: REMOTE_MESSAGES.stale };
+                if (live.scope !== "act")
+                    return { status: 403, message: REMOTE_MESSAGES.read };
+            }
+        }
         const current = store.accountOf(who.name);
-        if (current === null || current.revokedAt !== null || current.role !== who.role || (who.via === "cookie" && current.generation !== who.session.generation)) {
+        if (current === null || current.revokedAt !== null || current.role !== who.role || current.generation !== (who.via === "cookie" ? who.session.generation : who.generation)) {
             return { status: 403, message: "Your access changed. Sign in again." };
         }
         const type = request.headers["content-type"] ?? "";
@@ -1308,7 +1361,8 @@ export function createDecisionServer(options) {
             return;
         if (await cliEndpoint(request, response))
             return;
-        if (options.configDir !== undefined && await handleTeamsHttp(request, response, { store, dir: options.configDir, ...(options.teamsFetcher ? { fetcher: options.teamsFetcher } : {}), clock }))
+        if (options.configDir !== undefined && await handleTeamsHttp(request, response, { store, dir: options.configDir, ...(options.teamsFetcher ? { fetcher: options.teamsFetcher } : {}), clock,
+            admitSource: request => teamsSourceBudget.admit(joinSourceOf(request)), admitTenant: tenant => teamsTenantBudget.admit(tenant) }))
             return;
         if (serveBrowserAsset(request, response, url.pathname))
             return;
@@ -1364,7 +1418,30 @@ export function createDecisionServer(options) {
         const fragmentName = url.searchParams.get("fragment");
         const workspaceRead = method === "GET" && url.searchParams.get('format') === 'workspace';
         const touch = !(method === "GET" && (workspaceRead || (fragmentName !== null && NO_TOUCH_FRAGMENTS.has(fragmentName)) || /^\/code\/[a-f0-9]{32}\/state$/.test(url.pathname)));
-        const who = identify(request, touch);
+        const refuseBudget = (admitted) => {
+            if (admitted.ok)
+                return false;
+            request.resume();
+            if (admitted.status === 429)
+                response.setHeader("Retry-After", String(admitted.retryAfter));
+            respond(response, admitted.status, "text/plain; charset=utf-8", admitted.status === 429 ? limitWords(admitted.limit, admitted.retryAfter) : "Request limits could not be checked; nothing ran. Try again shortly.");
+            return true;
+        };
+        // One source charge before password proof and one account/token charge after it, including GET /login.
+        if (refuseBudget(admitPasswordSource(request)))
+            return;
+        const refusedToken = {};
+        const who = identify(request, touch, false, refusedToken);
+        if (refusedToken.principal !== undefined) {
+            if (refuseBudget(requestBudget.admit(refusedToken.principal.tokenId, "api")))
+                return;
+            if (method === "POST") {
+                request.resume();
+                return respond(response, 403, "text/plain; charset=utf-8", REMOTE_MESSAGES["step-up"]);
+            }
+        }
+        if (who?.via === "bearer" && refuseBudget(admitBearer(request, who)))
+            return;
         if (url.pathname === "/login" && method === "GET") {
             if (options.setupCode !== undefined && store.listApprovers().length === 0) {
                 return page(response, 200, signupPage(null, setupAttemptsLeft));
@@ -6635,15 +6712,15 @@ export function createDecisionServer(options) {
         }
         switch (verb) {
             case "approve": {
+                if (who.via !== "cookie")
+                    return refuse(response, who, 403, REMOTE_MESSAGES["step-up"]);
                 // Step-up, identical to a scope's: the session got you here; only
                 // the password agrees. The digest names what was seen.
                 const digest = body.get("digest") ?? "";
                 const token = body.get("token") ?? "";
-                if (who.via === "cookie") {
-                    const nonce = body.get("nonce") ?? "";
-                    if (!consumeApprovalNonce(nonce, who.name, `routine:${routine.id}`, digest)) {
-                        return routinePage(response, who, routineId, "that approval form is stale — read it again", 409);
-                    }
+                const nonce = body.get("nonce") ?? "";
+                if (!consumeApprovalNonce(nonce, who.name, `routine:${routine.id}`, digest)) {
+                    return routinePage(response, who, routineId, "that approval form is stale — read it again", 409);
                 }
                 if (token === "" && !hasFreshIdentitySignIn(who.name)) {
                     return routinePage(response, who, routineId, "approval requires your password, typed again", 400);
@@ -6677,19 +6754,18 @@ export function createDecisionServer(options) {
                 return redirect(response, `/routines/${routineId}`);
             }
             case "run-now": {
+                if (who.via !== "cookie")
+                    return refuse(response, who, 403, REMOTE_MESSAGES["step-up"]);
                 // Step-up (Codex Phase C review, M3): run-now is spend outside the
                 // approved schedule, so a session alone cannot ask for it — the
-                // password is typed again, like an approval. A bearer caller
-                // re-proved its credential on this very request.
-                if (who.via === "cookie") {
-                    const token = body.get("token") ?? "";
-                    if (token === "" && !hasFreshIdentitySignIn(who.name)) {
-                        return routinePage(response, who, routineId, "run now requires your password, typed again", 400);
-                    }
-                    const authenticated = authenticateApprover(store, who.name, token);
-                    if (!authenticated.ok) {
-                        return routinePage(response, who, routineId, "that is not your password", 403);
-                    }
+                // password is typed again, like an approval.
+                const token = body.get("token") ?? "";
+                if (token === "" && !hasFreshIdentitySignIn(who.name)) {
+                    return routinePage(response, who, routineId, "run now requires your password, typed again", 400);
+                }
+                const authenticated = authenticateApprover(who, token);
+                if (!authenticated.ok) {
+                    return routinePage(response, who, routineId, "that is not your password", 403);
                 }
                 const outcome = fireRoutine(store, routineId, now, { manual: true });
                 if (!outcome.ok) {
@@ -6876,7 +6952,7 @@ export function createDecisionServer(options) {
                     const repo = body.get('repo') ?? '';
                     if (!permitted(repo))
                         return fail(403, 'Choose a project available to your account.');
-                    if (!authenticateApprover(store, who.name, body.get('password') ?? '').ok)
+                    if (!authenticateApprover(who, body.get('password') ?? '').ok)
                         return fail(403, 'Enter your Toolroll password to authorize this coding session.');
                     const session = await coding.start(actor, { repo, title: body.get('title') ?? '', model: body.get('model')?.trim() || null, prompt: body.get('prompt') ?? '', requestId: body.get('requestId') ?? '' });
                     id = session.id;
@@ -6911,7 +6987,7 @@ export function createDecisionServer(options) {
                         const decision = body.get('decision');
                         if (decision !== 'accept' && decision !== 'decline' && decision !== 'cancel')
                             return fail(400, 'Choose an explicit decision for this request.');
-                        if (pending.kind !== 'questions' && decision === 'accept' && !authenticateApprover(store, who.name, body.get('password') ?? '').ok)
+                        if (pending.kind !== 'questions' && decision === 'accept' && !authenticateApprover(who, body.get('password') ?? '').ok)
                             return fail(403, 'Enter your password to approve this additional access.');
                         const answers = body.has('answers') ? JSON.parse(body.get('answers')) : Object.fromEntries(pending.questions.map(q => [q.id, { answers: [body.get(`question:${q.id}`) ?? ''] }]));
                         coding.answer(id, actor, token, decision, answers);
@@ -7328,7 +7404,7 @@ export function createDecisionServer(options) {
                     return renewed.ok ? settle(renewed.said, { reveal: renewed.reveal }) : answer(409, { ok: false, said: renewed.message });
                 }
                 // Linear's signing secret, pasted on this secure panel behind the password — never in chat.
-                if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+                if (!authenticateApprover(who, body.get("password") ?? "").ok)
                     return answer(403, { ok: false, said: "Enter your Toolroll password to save a secret." });
                 const saved = saveLinearSigningSecret(trigger, body.get("secret") ?? "", dir);
                 return saved.ok ? settle("Signing secret saved. Linear's deliveries can be proved now.") : answer(400, { ok: false, said: saved.message });
@@ -7366,7 +7442,7 @@ export function createDecisionServer(options) {
                     removeLinearKey(dir);
                     return settle("Linear key removed.");
                 }
-                if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+                if (!authenticateApprover(who, body.get("password") ?? "").ok)
                     return answer(403, { ok: false, said: "Enter your Toolroll password to save a key." });
                 const saved = saveLinearKey(dir, body.get("key") ?? "");
                 return saved.ok ? settle("Linear key saved on this computer.") : answer(400, { ok: false, said: saved.message });
@@ -7466,7 +7542,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets budgets.", "/spend");
             const back = (key, words) => redirect(response, `/spend?${key}=${encodeURIComponent(words)}`);
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", "Enter your Toolroll password to change a budget.");
             const target = /^(installation|project|person|teammate):(.+)$/.exec(body.get("target") ?? "");
             if (target === null)
@@ -7530,7 +7606,7 @@ export function createDecisionServer(options) {
                 return back("problem", `Nothing was deleted: ${view.running.join(", ")}. Stop it, then try again.`);
             if (body.get("step") !== "delete")
                 return confirm(null);
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return confirm("That password didn't match. Nothing was deleted.");
             const done = await deleteProject(store, repo, { actor: who.name, via: "console", now, evidenceRoot, poolRoot: options.poolRoot ?? null });
             if (!done.ok)
@@ -7559,7 +7635,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets the policy.", "/settings/policy");
             const back = (key, words) => redirect(response, `/settings/policy?${key}=${encodeURIComponent(words)}`);
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", "That password didn't match. Nothing changed.");
             const chosen = body.getAll("provider");
             const checked = checkPolicy({ providers: chosen.length === 4 ? null : chosen, models: parseList(body.get("models")), tools: parseList(body.get("tools")), ceiling: body.get("ceiling") ?? "" });
@@ -7580,7 +7656,7 @@ export function createDecisionServer(options) {
             if (!known.includes(repo))
                 return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
             const back = (key, words) => redirect(response, `/settings/approval?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", "That password didn't match. Nothing changed.");
             const protect = body.get("protect") ?? "none";
             const paths = parseProtectedPaths(body.get("paths") ?? "");
@@ -7603,7 +7679,7 @@ export function createDecisionServer(options) {
             const token = target === "*" ? null : store.apiTokens(null).find(one => one.id === target && one.revokedAt === null) ?? null;
             if (target !== "*" && token === null)
                 return back("problem", "That token is no longer live. Nothing changed.");
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", "Enter your Toolroll password to change request limits.");
             const read = (name) => parseLimit(body.get(name) ?? "", name === "per-day" ? REQUEST_BUDGET_PER_DAY_MAX : REQUEST_BUDGET_PER_MINUTE_MAX);
             const clear = body.get("action") === "clear";
@@ -7664,7 +7740,7 @@ export function createDecisionServer(options) {
                     return back("problem", "A viewer's token can only read.");
                 // A token is a credential: made with the person's password (or their identity provider's check from moments ago), counted once.
                 const typed = body.get("password") ?? "";
-                const confirmed = who.role === "approver" ? authenticateApprover(store, who.name, typed).ok
+                const confirmed = who.role === "approver" ? authenticateApprover(who, typed).ok
                     : typed === "" ? requestContext.getStore()?.sso?.fresh === true : authenticateAccount(store, who.name, typed).ok;
                 if (!confirmed)
                     return back("problem", "Enter your Toolroll password to make a token.");
@@ -7690,7 +7766,7 @@ export function createDecisionServer(options) {
                 const found = await providerFor(before.issuer);
                 return found.ok ? back("said", `${before.label} answers: it's ready for people to sign in.`) : back("problem", found.said);
             }
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", "Enter your Toolroll password to change sign-in.");
             if (action === "remove") {
                 removeSsoSettings(options.configDir);
@@ -7727,7 +7803,7 @@ export function createDecisionServer(options) {
             }
             if (url.pathname === "/settings/updates/cancel")
                 return back("said", requestRuntimeUpdateCancel(stateDir));
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", "Enter your Toolroll password to update.");
             const version = body.get("version") ?? "";
             const when = { now: "now", "when-idle": "when-idle", tonight: "at" }[body.get("when") ?? ""] ?? null;
@@ -7766,7 +7842,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator sets retention.", "/settings");
             const back = (key, words) => redirect(response, `/settings/retention?${key}=${encodeURIComponent(words)}`);
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", "Enter your Toolroll password to change retention.");
             const before = store.retentionPeriods();
             // Only what the page offers (or the period already set): a hand-made value doesn't save.
@@ -7788,7 +7864,7 @@ export function createDecisionServer(options) {
                 return refuse(response, who, 403, "An instance operator looks after storage.", "/settings");
             const back = (key, words) => redirect(response, `/settings/storage?${key}=${encodeURIComponent(words)}`);
             const what = url.pathname.endsWith("/clean") ? "clean up" : url.pathname.endsWith("/discard") ? "discard a checkout" : "change checkout cleanup";
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", `Enter your Toolroll password to ${what}.`);
             if (url.pathname === "/settings/storage") {
                 const cleanup = parseCleanup(body.get("cleanup") ?? "");
@@ -7819,13 +7895,15 @@ export function createDecisionServer(options) {
             const body = readForm(posted, CONSOLE_FORMS.pullRequests);
             const repo = body.get("repo") ?? "";
             const known = [...new Set([...managedRepos(), ...store.knownRepos(), ...store.listProjects().map(one => one.path)])];
-            if (who.via !== "cookie" || !known.includes(repo) || !visible(repo))
+            if (who.via !== "cookie")
+                return refuse(response, who, 403, REMOTE_MESSAGES["step-up"]);
+            if (!known.includes(repo) || !visible(repo))
                 return refuse(response, who, 404, "No such project.", "/projects");
             if (who.role !== "approver" || store.isDemo())
                 return refuse(response, who, 403, "An approver sets up pull requests.", "/projects");
             const back = (key, words) => redirect(response, `/settings/pull-requests?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
             const act = body.get("act");
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "", repo).ok)
+            if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
                 return back("problem", "Enter your Toolroll password to change pull requests.");
             if (act === "on") {
                 const checked = await checkPublishing(repo, options.publishExec === undefined ? {} : { exec: options.publishExec });
@@ -7857,12 +7935,14 @@ export function createDecisionServer(options) {
             const body = readForm(posted, CONSOLE_FORMS.checks);
             const repo = body.get("repo") ?? "";
             const known = [...new Set([...managedRepos(), ...store.knownRepos(), ...store.listProjects().map(one => one.path)])];
-            if (who.via !== "cookie" || !known.includes(repo) || !visible(repo))
+            if (who.via !== "cookie")
+                return refuse(response, who, 403, REMOTE_MESSAGES["step-up"]);
+            if (!known.includes(repo) || !visible(repo))
                 return refuse(response, who, 404, "No such project.", "/projects");
             if (who.role !== "approver" || store.isDemo())
                 return refuse(response, who, 403, "An approver sets a project's checks.", "/projects");
             const back = (key, words) => redirect(response, `/settings/checks?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "", repo).ok)
+            if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
                 return back("problem", "Enter your Toolroll password to change checks.");
             const act = body.get("act");
             // The automatic review switch: the policy log keeps before → after.
@@ -7921,7 +8001,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || databaseFile === null)
                 return refuse(response, who, 403, "An instance operator looks after backups.", "/settings");
             const back = (key, words) => redirect(response, `/settings/backups?${key}=${encodeURIComponent(words)}`);
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", "Enter your Toolroll password to change backups.");
             const every = body.get("every") ?? "";
             const hours = Number(every);
@@ -7946,7 +8026,7 @@ export function createDecisionServer(options) {
             const body = readForm(posted, CONSOLE_FORMS.data);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator exports data.", "/settings");
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok) {
+            if (!authenticateApprover(who, body.get("password") ?? "").ok) {
                 return redirect(response, `/settings/data?problem=${encodeURIComponent("Enter your Toolroll password to download the export.")}`);
             }
             store.recordAction({ at: now.toISOString(), actor: who.name, repo: null, taskId: null, runId: null, action: "everything exported", outcome: "exported", source: "access", detail: "downloaded as a .zip" });
@@ -7991,7 +8071,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name) || !options.configDir)
                 return refuse(response, who, 403, "An instance operator sets up monitoring.", "/settings");
             const back = (key, words) => redirect(response, `/settings/monitoring?${key}=${encodeURIComponent(words)}`);
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("problem", "Enter your Toolroll password to change monitoring.");
             const before = readMonitoring(options.configDir);
             // Never into Toolroll's own folder, a project or the build checkouts: an agent could read the stream there.
@@ -8048,7 +8128,7 @@ export function createDecisionServer(options) {
                 if (connectionsOf(store, target).find(one => one.id === service.id)?.state !== "open")
                     return back(`${projectName(target)} already has ${service.label}.`);
             }
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return back("Enter your Toolroll password to connect a tool.");
             // An app on this computer: added like a common tool and tested; one that can't be reached isn't kept.
             if (local !== null) {
@@ -8103,7 +8183,7 @@ export function createDecisionServer(options) {
             const action = body.get("action") ?? "";
             const name = body.get("name") ?? "";
             // Anything that adds what a build can run or reach, or a secret, needs the password.
-            if (["add-catalog", "add-custom", "import", "secret"].includes(action) && !authenticateApprover(store, who.name, body.get("password") ?? "").ok) {
+            if (["add-catalog", "add-custom", "import", "secret"].includes(action) && !authenticateApprover(who, body.get("password") ?? "").ok) {
                 return back("problem", "Enter your Toolroll password to change this project's tools.");
             }
             const now = clock();
@@ -8358,6 +8438,8 @@ export function createDecisionServer(options) {
         }
         if (["/control/setup-preview", "/control/setup-approve", "/control/instructions-preview", "/control/instructions-approve"].includes(url.pathname)) {
             const body = readForm(posted, CONSOLE_FORMS.projectSetup);
+            if (who.via !== "cookie")
+                return refuse(response, who, 403, REMOTE_MESSAGES["step-up"]);
             const project = projectOf(who, request);
             if (project == null || body.get("repo") !== project || !visible(project))
                 return refuse(response, who, 409, "The selected project changed. Open project setup again.", "/control");
@@ -8373,7 +8455,7 @@ export function createDecisionServer(options) {
                 }
                 if (who.via === "cookie" && !consumeApprovalNonce(body.get("nonce") ?? "", who.name, nonceKey, body.get("fingerprint") ?? ""))
                     return refuse(response, who, 409, "This instruction preview expired. Review it again.", "/control");
-                if (!authenticateApprover(store, who.name, body.get("token") ?? "").ok)
+                if (!authenticateApprover(who, body.get("token") ?? "").ok)
                     return refuse(response, who, 403, "Your operator credential is required.", "/control");
                 const added = addProjectInstructions(project, body.get("fingerprint") ?? "");
                 if (!added.ok)
@@ -8411,7 +8493,7 @@ export function createDecisionServer(options) {
                 savePrimary(dir, "slack");
                 return redirect(response, "/settings/slack");
             }
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return show("Enter your Toolroll password to change Slack access.", 403);
             const generation = store.accountOf(who.name).generation;
             if (action === "connect") {
@@ -8544,7 +8626,7 @@ export function createDecisionServer(options) {
                 savePrimary(dir, "teams");
                 return redirect(response, "/settings/teams");
             }
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return show("Enter your Toolroll password to change Teams access.", 403);
             const generation = store.accountOf(who.name).generation;
             if (action === "connect") {
@@ -8599,7 +8681,7 @@ export function createDecisionServer(options) {
                 savePrimary(dir, "discord");
                 return redirect(response, "/settings/discord");
             }
-            if (!authenticateApprover(store, who.name, body.get("password") ?? "").ok)
+            if (!authenticateApprover(who, body.get("password") ?? "").ok)
                 return show("Enter your Toolroll password to change Discord access.", 403);
             const generation = store.accountOf(who.name).generation;
             if (action === "connect") {
@@ -9139,7 +9221,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "runner registration is a browser surface");
             const token = body.get("token") ?? "";
-            if (!authenticateApprover(store, who.name, token).ok) {
+            if (!authenticateApprover(who, token).ok) {
                 return refuse(response, who, 403, "registering a worker takes your password, typed again", "/fleet");
             }
             const name = (body.get("name") ?? "").trim();
@@ -9240,7 +9322,7 @@ export function createDecisionServer(options) {
                 return refuse(response, who, 409, "the terms moved while you were reading — read them again", "/mode");
             }
             const token = body.get("token") ?? "";
-            if (!authenticateApprover(store, who.name, token).ok) {
+            if (!authenticateApprover(who, token).ok) {
                 return refuse(response, who, 403, "signing a mode takes your password, typed again", "/mode");
             }
             store.signMode({
@@ -9269,7 +9351,7 @@ export function createDecisionServer(options) {
             const body = readForm(posted, CONSOLE_FORMS.peopleProjects);
             if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
                 return refuse(response, who, 403, "An instance operator manages project access.", "/people");
-            if (!authenticateApprover(store, who.name, body.get("token") ?? "", null).ok)
+            if (!authenticateApprover(who, body.get("token") ?? "", null).ok)
                 return refuse(response, who, 403, "Saving access requires your password.", "/people");
             const access = readAccessForm(body);
             if (!access.ok)
@@ -9287,7 +9369,7 @@ export function createDecisionServer(options) {
             const token = body.get("token") ?? "";
             // RAISING authority is a password ceremony (the doctrine): adding a
             // person to the instance is exactly that.
-            if (!authenticateApprover(store, who.name, token).ok) {
+            if (!authenticateApprover(who, token).ok) {
                 return refuse(response, who, 403, "making an invite takes your password, typed again", "/people");
             }
             const role = body.get("role") === "approver" ? "approver" : "viewer";
@@ -9316,7 +9398,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "inviting is a browser surface");
             const token = body.get("token") ?? "";
-            if (!authenticateApprover(store, who.name, token).ok) {
+            if (!authenticateApprover(who, token).ok) {
                 return refuse(response, who, 403, "cancelling an invite takes your password, typed again", "/people");
             }
             const id = Number(body.get("id") ?? "");
@@ -9328,7 +9410,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "removing a person is a browser surface");
             const token = body.get("token") ?? "";
-            if (!authenticateApprover(store, who.name, token).ok) {
+            if (!authenticateApprover(who, token).ok) {
                 return refuse(response, who, 403, "removing a person takes your password, typed again", "/people");
             }
             const name = (body.get("name") ?? "").trim();
@@ -9348,7 +9430,7 @@ export function createDecisionServer(options) {
             if (who.via !== "cookie")
                 return refuse(response, who, 403, "runner retirement is a browser surface");
             const token = body.get("token") ?? "";
-            if (!authenticateApprover(store, who.name, token).ok) {
+            if (!authenticateApprover(who, token).ok) {
                 return refuse(response, who, 403, "retiring a worker takes your password, typed again", "/fleet");
             }
             const name = (body.get("name") ?? "").trim();
@@ -9399,6 +9481,8 @@ export function createDecisionServer(options) {
         }
         const contestAct = /^\/contest\/([0-9]{1,15})\/(arm|pick|abandon)$/.exec(url.pathname);
         if (contestAct !== null) {
+            if (who.via !== "cookie")
+                return refuse(response, who, 403, REMOTE_MESSAGES["step-up"]);
             const body = readForm(posted, CONSOLE_FORMS.contest);
             const contestId = Number(contestAct[1]);
             const verb = contestAct[2];
@@ -9451,7 +9535,7 @@ export function createDecisionServer(options) {
             // POST minted. The store consumes the nonce conditionally inside the
             // same transaction that moves the tournament — replay finds it gone.
             const token = body.get("token") ?? "";
-            if (!authenticateApprover(store, who.name, token).ok) {
+            if (!authenticateApprover(who, token).ok) {
                 return contestScreen(response, who, contestId, "that decision takes your password, typed again", 403);
             }
             const nonceValue = body.get("nonce") ?? "";
@@ -9493,7 +9577,7 @@ export function createDecisionServer(options) {
             if (run === null || runTask === null || familyOf(runTask)?.root.id !== (familyOf(act.taskId)?.root.id ?? act.taskId)) {
                 return taskScreen(response, who, act.taskId, "That build isn't part of this task.", 409);
             }
-            if (!authenticateApprover(store, who.name, body.get("token") ?? "", ref.repo).ok || !store.accountCanAccess(who.name, ref.repo)) {
+            if (!authenticateApprover(who, body.get("token") ?? "", ref.repo).ok || !store.accountCanAccess(who.name, ref.repo)) {
                 return taskScreen(response, who, act.taskId, "That password didn't match. Nothing changed.", 403);
             }
             // When Toolroll can't check at all, the approver also says they checked: never a one-click confirmation.
@@ -9601,7 +9685,7 @@ export function createDecisionServer(options) {
             // (finding 22/33) — the record is consumed from the RETURNED live
             // session, synchronously, before the first await.
             const password = body.get("token") ?? "";
-            if (password === "" || !authenticateApprover(store, who.name, password).ok) {
+            if (password === "" || !authenticateApprover(who, password).ok) {
                 return projectsScreen(response, who, "cloning takes your password, typed again", 403);
             }
             const cookieId = /(?:^|;\s*)standing-orders_session=([0-9a-f]{64})/.exec(request.headers.cookie ?? "")?.[1];
@@ -9669,7 +9753,7 @@ export function createDecisionServer(options) {
             if (store.isDemo())
                 return refuse(response, who, 403, "the sandbox never pushes");
             const password = body.get("token") ?? "";
-            if (password === "" || !authenticateApprover(store, who.name, password).ok) {
+            if (password === "" || !authenticateApprover(who, password).ok) {
                 return redirect(response, `/settings?said=${encodeURIComponent("enrolling this device takes your password, typed again")}`);
             }
             const endpoint = body.get("endpoint") ?? "";
@@ -9772,7 +9856,7 @@ export function createDecisionServer(options) {
                 return refuse(response, who, 403, "chat setup is a browser surface");
             const back = body.get("return") === "/settings/lead" ? "/settings/lead" : safeChatReturn(body.get("return"));
             const password = body.get("token") ?? "";
-            if (password === "" || !authenticateApprover(store, who.name, password).ok) {
+            if (password === "" || !authenticateApprover(who, password).ok) {
                 return redirect(response, chatReturnWithSaid(back, "configuring chat spend takes your password, typed again"));
             }
             if (body.get("off") === "1") {
@@ -10098,7 +10182,7 @@ export function createDecisionServer(options) {
             // The password, typed again, on EVERY message (v2 ruling 2): chat is
             // spend, and a seven-day cookie is not a spend credential.
             const password = body.get("token") ?? "";
-            if (password === "" || !authenticateApprover(store, who.name, password).ok) {
+            if (password === "" || !authenticateApprover(who, password).ok) {
                 return redirect(response, `/chat?said=${encodeURIComponent("chat spends — your password, typed again, with every message")}`);
             }
             const message = (body.get("message") ?? "").trim();
@@ -10167,7 +10251,7 @@ export function createDecisionServer(options) {
             const candidate = chat?.candidates.get(key);
             // The filing act creates durable rows from model text: password again.
             const password = body.get("token") ?? "";
-            if (password === "" || !authenticateApprover(store, who.name, password).ok) {
+            if (password === "" || !authenticateApprover(who, password).ok) {
                 return redirect(response, `/chat?said=${encodeURIComponent("filing a draft takes your password, typed again")}`);
             }
             if (chat === undefined || candidate === undefined) {
@@ -10240,7 +10324,7 @@ export function createDecisionServer(options) {
             if (turn === null)
                 return refuse(response, who, 404, "no such turn", "/chat");
             const password = body.get("token") ?? "";
-            if (password === "" || !authenticateApprover(store, who.name, password).ok) {
+            if (password === "" || !authenticateApprover(who, password).ok) {
                 return refuse(response, who, 403, "acknowledging unknown spend takes your password", "/chat");
             }
             const nonce = body.get("nonce") ?? "";
@@ -10948,7 +11032,7 @@ export function createDecisionServer(options) {
             }
             basis = { kind: "mode", digest: mode.digest };
         }
-        else if (!authenticateApprover(store, who.name, token).ok) {
+        else if (!authenticateApprover(who, token).ok) {
             return refuse(response, who, 403, "authorizing takes your password, typed again", taskHref(taskId));
         }
         const minted = store.mintAttendedAuthorization({
@@ -11125,7 +11209,7 @@ export function createDecisionServer(options) {
                 // Authenticated like every approving act: the session alone may
                 // read; resuming external work takes the password, typed again.
                 const token = (body.get("token") ?? "").trim();
-                const authenticated = token !== "" ? authenticateApprover(store, who.name, token) : null;
+                const authenticated = token !== "" ? authenticateApprover(who, token) : null;
                 if (authenticated === null || !authenticated.ok) {
                     return taskScreen(response, who, taskId, "reopening takes your password, typed again", 403);
                 }
@@ -11306,7 +11390,7 @@ export function createDecisionServer(options) {
                     // authority takes the password ceremony again — the same act
                     // that would be required to approve that authority from scratch.
                     const token = (body.get("token") ?? "").trim();
-                    if (!authenticateApprover(store, who.name, token).ok) {
+                    if (!authenticateApprover(who, token).ok) {
                         return taskScreen(response, who, taskId, "accepting this revision takes your password, typed again", 403);
                     }
                 }
@@ -11622,6 +11706,8 @@ export function createDecisionServer(options) {
                 return redirect(response, taskHref(taskId));
             }
             case "approve": {
+                if (who.via !== "cookie")
+                    return refuse(response, who, 403, REMOTE_MESSAGES["step-up"]);
                 const body = readForm(posted, CONSOLE_FORMS.taskApprove);
                 const requestedReturn = body.get("return");
                 const approvalBack = requestedReturn === "next"
@@ -11644,11 +11730,9 @@ export function createDecisionServer(options) {
                 // rendered to this approver and is spent either way.
                 const digest = body.get("digest") ?? "";
                 const token = body.get("token") ?? "";
-                if (who.via === "cookie") {
-                    const nonce = body.get("nonce") ?? "";
-                    if (!consumeApprovalNonce(nonce, who.name, taskId, digest)) {
-                        return approvalProblem("that approval form is stale — read it again", 409);
-                    }
+                const nonce = body.get("nonce") ?? "";
+                if (!consumeApprovalNonce(nonce, who.name, taskId, digest)) {
+                    return approvalProblem("that approval form is stale — read it again", 409);
                 }
                 if (token === "" && !hasFreshIdentitySignIn(who.name)) {
                     return approvalProblem("approval requires your password, typed again", 400);
@@ -11845,7 +11929,7 @@ export function createDecisionServer(options) {
                     return taskScreen(response, who, taskId, "which attempt? the resume names the exact stopped run", 400);
                 const runId = Number(named);
                 const token = body.get("token") ?? "";
-                if (!authenticateApprover(store, who.name, token).ok) {
+                if (!authenticateApprover(who, token).ok) {
                     return taskScreen(response, who, taskId, "resuming takes your password, typed again", 403);
                 }
                 const nonceValue = body.get("nonce") ?? "";
@@ -11925,7 +12009,7 @@ export function createDecisionServer(options) {
             approved: (() => { const scope = store.getScope(taskId); return scope !== null && approvalOf(scope).approved; })(),
         }));
     }
-    const mcpHttp = createMcpHttp({ store, clock, evidenceRoot, signedIn: request => identify(request, true, true) !== null, admit: person => requestBudget.admit(person.principal.tokenId, "mcp"),
+    const mcpHttp = createMcpHttp({ store, clock, evidenceRoot, ...(options.requestBudgetClock === undefined ? {} : { requestBudgetClock: options.requestBudgetClock }), signedIn: request => identify(request, true, true) !== null, admit: person => requestBudget.admit(person.principal.tokenId, "mcp"),
         resourceMetadata: request => { const origin = consoleOrigin(request.headers.host); return origin === null ? null : resourceMetadataUrl(origin); },
         enrolled: () => [...new Set([...managedRepos(), ...store.listProjects().map(project => project.path)])], ...(options.runOperateAs === undefined ? {} : { runAs: options.runOperateAs }) });
     // MCP sign-in: the console's own sign-in and step-up, a same-site consent form, and the person's current projects.
@@ -11948,9 +12032,10 @@ export function createDecisionServer(options) {
         // grant (their role, their projects) is checked beside it.
         confirm: (session, typed) => typed === "" ? session.sso?.fresh === true : authenticateAccount(store, session.name, typed).ok,
         projectsFor: account => store.knownRepos().filter(repo => store.accountCanAccess(account, repo)).sort(),
+        admitToken: request => oauthTokenBudget.admit(joinSourceOf(request)),
     });
     // ---- identity ------------------------------------------------------------
-    function identify(request, touch = true, limited = false) {
+    function identify(request, touch = true, limited = false, refusedToken) {
         // v101: an API token. Wrong ones spend the address's tries like a wrong password; expired or revoked ones, and a removed account's, name no one.
         const presented = /^Bearer (so_\S+)$/.exec(request.headers.authorization ?? "")?.[1];
         if (presented !== undefined) {
@@ -11967,16 +12052,20 @@ export function createDecisionServer(options) {
                 return null;
             // v111: a token limited to some projects signs in only where its limit travels with it (the remote CLI and MCP,
             // through Principal.projects); the console's own pages and APIs check the account's access alone, so it is refused there.
-            if (kept.row.projects !== null && !limited)
-                return null;
             const account = store.accountOf(kept.row.account);
             if (account === null || account.revokedAt !== null)
                 return null;
-            // v113: an MCP sign-in's token works only at /mcp, while its access secret is fresh (mcp-oauth.ts).
-            if (!oauthTokenAllowed(store, kept.row.id, new URL(request.url ?? "/", "http://placeholder").pathname, new Date(at)))
+            const principal = { kind: "person", account: kept.row.account, generation: account.generation, scope: kept.row.access, tokenId: kept.row.id,
+                projects: tokenProjects(tokenProjects(account.projects, kept.row.projects), oauthProjects(store, kept.row.id)) };
+            // Preserve proof only for a refusal and its admission charge. This never makes an OAuth token a console login.
+            if (!oauthTokenAllowed(store, kept.row.id, new URL(request.url ?? "/", "http://placeholder").pathname, new Date(at)) ||
+                (kept.row.projects !== null && !limited)) {
+                if (refusedToken !== undefined)
+                    refusedToken.principal = principal;
                 return null;
+            }
             store.touchApiToken(kept.row.id, new Date(at));
-            return { name: kept.row.account, via: "bearer", role: kept.row.access === "read" ? "viewer" : account.role, token: kept.row.name };
+            return { name: kept.row.account, via: "bearer", role: kept.row.access === "read" ? "viewer" : account.role, token: kept.row.name, generation: account.generation, principal };
         }
         const bearer = /^Bearer (.+):(.+)$/.exec(request.headers.authorization ?? "");
         if (bearer !== null) {
@@ -11987,7 +12076,7 @@ export function createDecisionServer(options) {
             const authenticated = authenticateAccount(store, bearer[1], bearer[2]);
             if (!authenticated.ok && authenticated.reason === "unknown")
                 signInBudget.failed(source, at);
-            return authenticated.ok && passwordAllowed(bearer[1]) ? { name: bearer[1], via: "bearer", role: authenticated.role } : null;
+            return authenticated.ok && passwordAllowed(bearer[1]) ? { name: bearer[1], via: "bearer", role: authenticated.role, generation: authenticated.generation } : null;
         }
         const cookies = request.headers.cookie ?? "";
         const match = new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([0-9a-f]{64})`).exec(cookies);