toolroll 0.9.48 → 0.9.49

package/dist/session-http.d.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type SessionOperation, type SessionRequests, type SessionResponse } from './session-contract.js';
+import { type Admission } from './request-budget.js';
 export type SessionHttpActor = {
     name: string;
     generation: number;
@@ -13,6 +14,10 @@ export type SessionHttpOptions = {
     /** The existing live owner's operation. Null means no owner is ready.
      * The service rechecks actor generation and project access at execution. */
     execute: SessionHttpExecute | null;
+    /** The bearer request's budget by source (request-budget.ts): charged once, before the credential is checked or a body read. */
+    admit?: (request: IncomingMessage) => Admission;
+    /** Account admission after successful authentication, before any body read or owner call. */
+    admitAuthenticated?: (request: IncomingMessage, actor: SessionHttpActor) => Admission;
 };
 /** Handle this API family before the browser's form parser or login redirects.
  * This adapter dispatches at most once. It owns no catalog, database or provider. */

package/dist/session-http.js

@@ -1,4 +1,5 @@
 import { SESSION_REQUEST_BYTES, SESSION_RESPONSE_BYTES, isSessionResponse, sessionDescriptor, validateSessionRequest, } from './session-contract.js';
+import { limitWords } from './request-budget.js';
 function readBody(request) {
     return new Promise(resolve => {
         let size = 0;
@@ -99,6 +100,16 @@ export async function handleSessionHttp(request, response, options) {
     if (authorizationCount !== 1 || !/^Bearer (.+):(.+)$/.test(request.headers.authorization ?? '')) {
         return reject(401, 'unauthenticated', 'Current operator bearer credentials are required.');
     }
+    const refuseAdmission = (admitted) => {
+        if (admitted.ok)
+            return false;
+        if (admitted.status === 503)
+            return reject(503, 'limits-unavailable', 'Request limits could not be checked; nothing ran. Try again shortly.');
+        response.setHeader('retry-after', String(admitted.retryAfter));
+        return reject(429, 'rate-limited', limitWords(admitted.limit, admitted.retryAfter));
+    };
+    if (options.admit && refuseAdmission(options.admit(request)))
+        return true;
     let actor;
     try {
         actor = await options.authenticate(request);
@@ -109,6 +120,8 @@ export async function handleSessionHttp(request, response, options) {
     if (actor === null || typeof actor.name !== 'string' || !actor.name.trim() || !Number.isSafeInteger(actor.generation) || actor.generation < 1) {
         return reject(401, 'unauthenticated', 'Current operator bearer credentials are required.');
     }
+    if (options.admitAuthenticated && refuseAdmission(options.admitAuthenticated(request, actor)))
+        return true;
     const media = request.headers['content-type']?.split(';')[0]?.trim().toLowerCase();
     if (media !== 'application/json')
         return reject(415, 'unsupported-media-type', 'Send the session request as application/json.');

package/dist/session-server.d.ts

@@ -1,6 +1,8 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { Store } from './store.js';
 import type { CodingWorkspace } from './coding-workspace.js';
+import { type SessionHttpActor } from './session-http.js';
+import type { Admission } from './request-budget.js';
 /** Bind the transport to createDecisionServer's existing catalog owner and
  * live project admission. No cookie, coordinator token or caller-supplied actor
  * can acquire installation-wide native coding authority through this adapter. */
@@ -9,4 +11,7 @@ export declare function createSessionEndpoint(options: {
     workspace: CodingWorkspace | null;
     projects: () => readonly string[];
     projectAllowed: (repo: string) => boolean;
+    /** The request's source budget (request-budget.ts), charged once before the password is checked. */
+    admit?: (request: IncomingMessage) => Admission;
+    admitAuthenticated?: (request: IncomingMessage, actor: SessionHttpActor) => Admission;
 }): (request: IncomingMessage, response: ServerResponse) => Promise<boolean>;

package/dist/session-server.js

@@ -21,6 +21,8 @@ export function createSessionEndpoint(options) {
         },
     });
     return (request, response) => handleSessionHttp(request, response, {
+        ...(options.admit === undefined ? {} : { admit: options.admit }),
+        ...(options.admitAuthenticated === undefined ? {} : { admitAuthenticated: options.admitAuthenticated }),
         authenticate: request => {
             const bearer = /^Bearer (.+):(.+)$/.exec(request.headers.authorization ?? '');
             if (!bearer)

package/dist/team-cli.js

@@ -41,6 +41,14 @@ existing local commands. Credentials stay in a private file, never in URLs or ar
 Reads and attachment do not start model work. Server permissions remain authoritative.`;
 export class UsageError extends Error {
 }
+/** Transport metadata stays local to the CLI; only an actual HTTP 429 permits a follower read retry. */
+const RETRY_AFTER_MS = Symbol('retry-after-ms');
+function retryDelay(header) {
+    const raw = header?.trim() ?? '';
+    const delay = /^\d+$/.test(raw) ? Number(raw) * 1000
+        : /^(Mon|Tue|Wed|Thu|Fri|Sat|Sun), /.test(raw) ? Date.parse(raw) - Date.now() : NaN;
+    return Number.isFinite(delay) && delay >= 0 ? Math.max(1000, Math.min(300_000, delay)) : 5000;
+}
 const value = (flags, name) => typeof flags[name] === 'string' ? flags[name] : '';
 const required = (flags, name) => { const result = value(flags, name); if (!result)
     throw new UsageError(`--${name} is required.`); return result; };
@@ -244,13 +252,18 @@ async function responseBody(response) {
 function failure(code, message, result) { return { version: 1, ok: false, code, message, ...(result === undefined ? {} : { result }) }; }
 async function perform(profile, request, options) {
     const reading = ['list', 'show'].includes(request.operation);
-    const unconfirmed = () => failure(reading ? 'service-unavailable' : 'delivery-unconfirmed', reading ? 'The service response could not be read.' : 'The response could not be confirmed. Inspect saved messages before continuing; this request was not retried.', { operation: request.operation, ...(request.args.conversationId ? { conversationId: request.args.conversationId } : {}), ...(request.args.requestId ? { requestId: request.args.requestId } : {}) });
+    const receipt = { operation: request.operation, ...(request.args.conversationId ? { conversationId: request.args.conversationId } : {}), ...(request.args.requestId ? { requestId: request.args.requestId } : {}) };
+    const unconfirmed = () => failure(reading ? 'service-unavailable' : 'delivery-unconfirmed', reading ? 'The service response could not be read.' : 'The response could not be confirmed. Inspect saved messages before continuing; this request was not retried.', receipt);
     try {
         const response = await (options.fetch ?? fetch)(`${profile.origin}/api/team`, { method: 'POST', redirect: 'manual', credentials: 'omit', signal: options.signal ? AbortSignal.any([options.signal, AbortSignal.timeout(30_000)]) : AbortSignal.timeout(30_000), headers: { authorization: bearerOf(profile), 'content-type': 'application/json', accept: 'application/json' }, body: JSON.stringify(request) });
         if (response.status >= 300 && response.status < 400) {
             await response.body?.cancel();
             return unconfirmed();
         }
+        if (response.status === 429) {
+            await response.body?.cancel();
+            return { ...failure('rate-limited', reading ? 'Request limit reached. Try again shortly.' : 'Request limit reached. Inspect saved messages before continuing; this request was not retried.', receipt), [RETRY_AFTER_MS]: retryDelay(response.headers.get('retry-after')) };
+        }
         const payload = await responseBody(response);
         if (!record(payload) || payload.version !== 1 || typeof payload.ok !== 'boolean' || typeof payload.code !== 'string' || typeof payload.message !== 'string' || payload.snapshot !== undefined && !isSnapshot(payload.snapshot) || payload.ok && !response.ok)
             return unconfirmed();
@@ -396,7 +409,7 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
         if (!profile || !Object.hasOwn(saved.profiles, profileName))
             throw new UsageError('No saved connection. Use connect with your individual sign-in first.');
         secret = profile.token;
-        const call = (operation, args) => perform(profile, { operation, args }, options);
+        const call = (operation, args, signal) => perform(profile, { operation, args }, { ...options, ...(signal === undefined ? {} : { signal }) });
         if (command === 'chat' || command === 'brief')
             return await chat(command, flags, profile.account, call, emit, options, stderr);
         let operation, args = {};
@@ -476,8 +489,8 @@ async function chat(command, flags, account, call, emit, options, stderr) {
         throw new UsageError('--terms-digest requires --authorize.');
     if (command === 'chat' && requestId && !flags.say)
         throw new UsageError('Use brief --request-id to inspect a previous message.');
-    const show = async () => {
-        const reply = await call('show', { conversationId });
+    const show = async (signal) => {
+        const reply = await call('show', { conversationId }, signal);
         if (reply.ok && (!reply.snapshot || reply.snapshot.selected?.id !== conversationId || leadId && reply.snapshot.selected.leadId !== leadId))
             return failure('conversation-mismatch', 'The service returned a different conversation or lead. Nothing was sent.');
         return reply;
@@ -577,22 +590,31 @@ async function chat(command, flags, account, call, emit, options, stderr) {
     };
     let pollResult = 0;
     const poll = async () => {
+        let waitMs = 2_000;
         while (!signal.aborted) {
             try {
-                await (options.sleep ?? ((ms, abort) => delay(ms, undefined, { signal: abort })))(2_000, signal);
+                await (options.sleep ?? ((ms, abort) => delay(ms, undefined, { signal: abort })))(waitMs, signal);
             }
             catch {
                 break;
             }
             if (signal.aborted)
                 break;
-            const next = await show();
+            const next = await show(signal);
+            if (signal.aborted)
+                break;
+            // Only this follower's read poll retries. Sends, authorizations and uncertain deliveries are never replayed.
+            if (!next.ok && next[RETRY_AFTER_MS] !== undefined) {
+                waitMs = next[RETRY_AFTER_MS];
+                continue;
+            }
             if (!next.ok) {
                 emit(next);
                 pollResult = 1;
                 controller.abort();
                 break;
             }
+            waitMs = 2_000;
             current = next;
             updated(next);
         }

package/dist/team-contract.d.ts

@@ -1,9 +1,12 @@
 import type { WorkIndexPage } from './work-index.js';
 import type { BrowserActionCard } from './browser-workspace.js';
+import type { Principal } from './operate-remote.js';
 /** Shared central-team transport contract. Requests never establish actor identity. */
 export type TeamActor = {
     name: string;
     generation: number;
+    /** Set when an `so_` API token signed in: its scope and project limit narrow every check, never widen one. */
+    principal?: Principal;
 };
 export type TeamRole = 'viewer' | 'contributor' | 'manager';
 export type TeamLead = {
@@ -81,6 +84,10 @@ export type TeamSnapshot = {
 };
 export declare const TEAM_OPERATIONS: readonly ['list', 'show', 'create-lead', 'update-lead', 'create-conversation', 'member', 'send', 'edit', 'withdraw', 'read', 'authorize', 'follow', 'stop', 'transfer'];
 export type TeamOperation = typeof TEAM_OPERATIONS[number];
+/** Whether each operation writes anything (a read receipt included). Exhaustive, so a new operation can't default to read. */
+export declare const TEAM_MUTATIONS: Readonly<Record<TeamOperation, boolean>>;
+/** Whether this actor may run `operation`: a read-scope token never writes. */
+export declare const teamScopeAllows: (actor: TeamActor, operation: TeamOperation) => boolean;
 export type TeamRequest = {
     operation: TeamOperation;
     args: Record<string, unknown>;

package/dist/team-contract.js

@@ -1 +1,8 @@
 export const TEAM_OPERATIONS = ['list', 'show', 'create-lead', 'update-lead', 'create-conversation', 'member', 'send', 'edit', 'withdraw', 'read', 'authorize', 'follow', 'stop', 'transfer'];
+/** Whether each operation writes anything (a read receipt included). Exhaustive, so a new operation can't default to read. */
+export const TEAM_MUTATIONS = {
+    list: false, show: false, 'create-lead': true, 'update-lead': true, 'create-conversation': true, member: true, send: true, edit: true,
+    withdraw: true, read: true, authorize: true, follow: true, stop: true, transfer: true,
+};
+/** Whether this actor may run `operation`: a read-scope token never writes. */
+export const teamScopeAllows = (actor, operation) => !TEAM_MUTATIONS[operation] || actor.principal === undefined || actor.principal.scope === 'act';

package/dist/team-http.d.ts

@@ -1,5 +1,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { type TeamActor, type TeamExecute } from './team-contract.js';
+import { type Admission } from './request-budget.js';
 export declare const TEAM_REQUEST_BYTES: number;
 export type TeamHttpOptions = {
     authenticate: (request: IncomingMessage) => TeamActor | null | Promise<TeamActor | null>;
@@ -9,6 +10,10 @@ export type TeamHttpOptions = {
     execute: TeamExecute;
     /** Current, authorized event cursor. null means the audience is no longer available. */
     cursor?: (actor: TeamActor, conversationId?: string) => number | null;
+    /** Source admission before credential verification. Streams are charged once when opened. */
+    admit?: (request: IncomingMessage) => Admission;
+    /** Proved account/token admission, before reading the body or executing any operation. */
+    admitAuthenticated?: (request: IncomingMessage, actor: TeamActor) => Admission;
     streamIntervalMs?: number;
     streams?: Set<ServerResponse>;
 };

package/dist/team-http.js

@@ -1,10 +1,11 @@
-import { TEAM_OPERATIONS } from './team-contract.js';
+import { TEAM_OPERATIONS, teamScopeAllows } from './team-contract.js';
+import { limitWords } from './request-budget.js';
 export const TEAM_REQUEST_BYTES = 64 * 1024;
 const failure = (code, message) => ({ version: 1, ok: false, code, message });
-function send(response, status, value) {
+function send(response, status, value, headers = {}) {
     if (response.destroyed || response.writableEnded)
         return;
-    response.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' });
+    response.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', ...headers });
     response.end(JSON.stringify(value));
 }
 async function body(request) {
@@ -40,6 +41,17 @@ export async function handleTeamHttp(request, response, options) {
     const count = request.rawHeaders.filter((value, index) => index % 2 === 0 && value.toLowerCase() === 'authorization').length;
     if (count > 1)
         return reject(400, 'ambiguous-credentials', 'Send one authorization header.');
+    const refuseAdmission = (admitted) => {
+        if (admitted.ok)
+            return false;
+        if (admitted.status === 503)
+            return reject(503, 'limits-unavailable', 'Request limits could not be checked; nothing ran. Try again shortly.');
+        send(response, 429, failure('rate-limited', limitWords(admitted.limit, admitted.retryAfter)), { 'retry-after': String(admitted.retryAfter) });
+        request.resume();
+        return true;
+    };
+    if (options.admit && refuseAdmission(options.admit(request)))
+        return true;
     let actor;
     try {
         actor = await options.authenticate(request);
@@ -49,6 +61,8 @@ export async function handleTeamHttp(request, response, options) {
     }
     if (!actor)
         return reject(401, 'unauthenticated', 'Sign in to continue.');
+    if (options.admitAuthenticated && refuseAdmission(options.admitAuthenticated(request, actor)))
+        return true;
     const conversationId = url.searchParams.get('conversation') ?? undefined;
     if (url.pathname === '/api/team/events') {
         if (request.method !== 'GET')
@@ -133,6 +147,8 @@ export async function handleTeamHttp(request, response, options) {
         return reject(405, 'method-not-allowed', 'Use GET or POST.');
     if (!options.revalidate(request, actor))
         return reject(401, 'unauthenticated', 'Sign in to continue.');
+    if (!teamScopeAllows(actor, input.operation))
+        return reject(403, 'read-only', 'Your token reads only. Use an act token for this.');
     try {
         const result = await options.execute(actor, input);
         send(response, result.ok ? 200 : /forbidden|access|unauthor|member/.test(result.code) ? 403 : 409, result);

package/dist/team-leads.d.ts

@@ -1,5 +1,5 @@
 import type { Store } from './store.js';
-import type { TeamActor, TeamConversation, TeamLead, TeamRequest, TeamResponse, TeamRole, TeamSnapshot } from './team-contract.js';
+import { type TeamActor, type TeamConversation, type TeamLead, type TeamRequest, type TeamResponse, type TeamRole, type TeamSnapshot } from './team-contract.js';
 export type TeamAccess = {
     conversation: TeamConversation;
     lead: TeamLead;
@@ -25,7 +25,11 @@ export declare class TeamLeads {
     readonly enrolled: () => readonly string[];
     constructor(store: Store, enrolled: () => readonly string[]);
     private get db();
+    /** The account as this actor may use it now. An API token's principal narrows it: a read token acts as a viewer, and a
+     * project-limited token sees only its projects. Every role and project check below reads this, never the raw row. */
     private account;
+    /** Whether the actor may use `repo` now: their account's access, narrowed by any token limit. */
+    private reaches;
     private leadRow;
     private leadProjects;
     private leadOf;

package/dist/team-leads.js

@@ -2,6 +2,8 @@ import { createHash, randomUUID } from 'node:crypto';
 import { scanForSecrets } from './evidence.js';
 import { ceilingDigestOf } from './principal.js';
 import { normalizeProjectAccess, projectAccessAllows, readProjectAccess } from './project-access.js';
+import { tokenProjects } from './api-tokens.js';
+import { teamScopeAllows } from './team-contract.js';
 class TeamRefusal extends Error {
     code;
     constructor(code, message) {
@@ -53,11 +55,22 @@ export class TeamLeads {
         this.enrolled = enrolled;
     }
     get db() { return this.store.handle; }
+    /** The account as this actor may use it now. An API token's principal narrows it: a read token acts as a viewer, and a
+     * project-limited token sees only its projects. Every role and project check below reads this, never the raw row. */
     account(actor) {
         const account = this.store.accountOf(actor.name);
         if (account === null || account.revokedAt !== null || account.generation !== actor.generation)
             refuse('signed-out', 'Sign in again to use this conversation.');
-        return account;
+        const principal = actor.principal;
+        if (principal === undefined)
+            return account;
+        if (principal.account !== actor.name || principal.generation !== actor.generation)
+            refuse('signed-out', 'Sign in again to use this conversation.');
+        return { ...account, role: principal.scope === 'act' ? account.role : 'viewer', projects: tokenProjects(account.projects, principal.projects) };
+    }
+    /** Whether the actor may use `repo` now: their account's access, narrowed by any token limit. */
+    reaches(actor, repo) {
+        return this.store.accountCanAccess(actor.name, repo) && projectAccessAllows(this.account(actor).projects, repo);
     }
     leadRow(id) {
         const row = this.db.prepare('SELECT * FROM team_lead WHERE id=?').get(id);
@@ -124,6 +137,28 @@ export class TeamLeads {
                 const { lead } = this.access(actor, conversationId);
                 return Number(this.db.prepare('SELECT COALESCE(MAX(id),0) AS n FROM team_event WHERE (conversation=? OR (conversation IS NULL AND lead=?))').get(conversationId, lead.id)?.['n'] ?? 0);
             }
+            // A project-limited token hears only of the leads and conversations it can open, never activity beyond its projects.
+            if (actor.principal?.projects != null) {
+                const account = this.account(actor);
+                const leads = this.db.prepare('SELECT l.id FROM team_lead l JOIN team_lead_member m ON m.lead=l.id WHERE m.account=? AND m.active=1').all(actor.name).map(r => String(r['id']))
+                    .filter(id => this.leadProjects(id).every(p => projectAccessAllows(account.projects, p) && this.enrolled().includes(p)));
+                const conversations = this.db.prepare('SELECT conversation FROM team_participant WHERE account=? AND active=1').all(actor.name).map(r => String(r['conversation']))
+                    .filter(id => { try {
+                    this.access(actor, id);
+                    return true;
+                }
+                catch (e) {
+                    if (e instanceof TeamRefusal)
+                        return false;
+                    throw e;
+                } });
+                let n = 0;
+                for (const id of leads)
+                    n = Math.max(n, Number(this.db.prepare('SELECT COALESCE(MAX(id),0) AS n FROM team_event WHERE lead=? AND conversation IS NULL').get(id)?.['n'] ?? 0));
+                for (const id of conversations)
+                    n = Math.max(n, Number(this.db.prepare('SELECT COALESCE(MAX(id),0) AS n FROM team_event WHERE conversation=?').get(id)?.['n'] ?? 0));
+                return n;
+            }
             return Number(this.db.prepare(`SELECT COALESCE(MAX(e.id),0) AS n FROM team_event e JOIN team_lead_member m ON m.lead=e.lead AND m.account=? AND m.active=1
         WHERE e.conversation IS NULL OR EXISTS(SELECT 1 FROM team_participant p JOIN team_conversation c ON c.id=p.conversation WHERE p.conversation=e.conversation AND p.account=? AND p.active=1 AND (c.visibility='team' OR c.created_by=?))`).get(actor.name, actor.name, actor.name)?.['n'] ?? 0);
         }
@@ -159,9 +194,12 @@ export class TeamLeads {
         try {
             const result = this.store.transact(() => {
                 this.account(actor);
+                if (!teamScopeAllows(actor, request.operation))
+                    refuse('read-only', 'Your token reads only. Use an act token for this.');
                 const requestId = request.args['requestId'];
                 const key = requestId === undefined ? null : str(requestId, 'Request ID', 128);
-                const digest = hash(stable(request));
+                // A token's scope and project limit are part of what was asked: a narrower token never replays a wider one's receipt.
+                const digest = hash(stable(actor.principal === undefined ? request : { request, scope: actor.principal.scope, projects: actor.principal.projects }));
                 if (key) {
                     const seen = this.db.prepare('SELECT payload_hash,response_json FROM team_request WHERE account=? AND generation=? AND request_id=?').get(actor.name, actor.generation, key);
                     if (seen) {
@@ -527,7 +565,7 @@ export class TeamLeads {
             if (ancestry.problem !== null)
                 return false;
             const ref = this.store.lookupRef(ancestry.chain[ancestry.chain.length - 1] ?? taskId);
-            if (!ref || ref.repo === null || !lead.projects.includes(ref.repo) || !this.store.accountCanAccess(actor.name, ref.repo))
+            if (!ref || ref.repo === null || !lead.projects.includes(ref.repo) || !this.reaches(actor, ref.repo))
                 return false;
             if (conversationId) {
                 const access = this.access(actor, conversationId, 'contributor');
@@ -546,7 +584,7 @@ export class TeamLeads {
         if (ancestry.problem !== null)
             refuse('invalid-task', 'Task history needs inspection before ownership can change.');
         const ref = this.store.lookupRef(ancestry.chain[ancestry.chain.length - 1] ?? taskId);
-        if (!ref || ref.repo === null || !target.projects.includes(ref.repo) || !this.store.accountCanAccess(actor.name, ref.repo))
+        if (!ref || ref.repo === null || !target.projects.includes(ref.repo) || !this.reaches(actor, ref.repo))
             refuse('forbidden', 'The receiving lead must have access to this task’s project.');
         const old = this.taskOwner(taskId), expected = integer(a['expectedRevision']);
         if ((old?.revision ?? 0) !== expected)

package/dist/team-runtime.d.ts

@@ -1,7 +1,7 @@
 import type { Store } from './store.js';
 import type { WorkspaceRevision } from './workspace-revision.js';
 import { TeamLeads } from './team-leads.js';
-import type { TeamActor, TeamExecute } from './team-contract.js';
+import { type TeamActor, type TeamExecute } from './team-contract.js';
 import { type MateTurnInput } from './mate.js';
 import { type TeamChatProviderResolver } from './team-chat-authorization.js';
 export type TeamRuntimeOptions = {

package/dist/team-runtime.js

@@ -4,6 +4,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { deliverTeamUpdates, startTeamUpdates } from './team-updates.js';
 import { workIndexPage } from './work-index.js';
 import { TeamLeads } from './team-leads.js';
+import { teamScopeAllows } from './team-contract.js';
 import { verifyApproverStanding } from './principal.js';
 import { credentialKeyOf, isDirectChatProvider, priceForConfig, subscriptionCredentialKey, mateWorstCaseForPrice } from './converse.js';
 import { runMateTurn } from './mate.js';
@@ -188,6 +189,8 @@ export function createTeamRuntime(options) {
     }
     const execute = async (actor, request) => {
         try {
+            if (!teamScopeAllows(actor, request.operation))
+                return response(false, 'read-only', 'Your token reads only. Use an act token for this.');
             if (request.operation === 'authorize')
                 return authorize(actor, request.args);
             if (request.operation === 'send' || request.operation === 'follow' && request.args['enabled'] === true) {

package/dist/teams.d.ts

@@ -2,6 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import { chatObject as object } from "./chat-delivery.js";
 import { type TeamsChatOptions } from "./teams-chat.js";
 import type { Store } from "./store.js";
+import { type Admission } from "./request-budget.js";
 export declare const TEAMS_ACTIVITY_BYTES: number;
 export declare const TEAMS_MESSAGES_PATH = "/teams/messages";
 /** The receiver: prove the Bot Framework token for this app, save the activity, acknowledge. Nothing runs here. */
@@ -10,6 +11,8 @@ export declare function handleTeamsHttp(request: IncomingMessage, response: Serv
     dir: string;
     fetcher?: typeof fetch;
     clock?: () => Date;
+    admitSource: (request: IncomingMessage) => Admission;
+    admitTenant: (tenant: string) => Admission;
 }): Promise<boolean>;
 /** The worker-side loop: a lease per installation, one pass a second. */
 export declare function followTeams(options: Omit<TeamsChatOptions, "identity" | "api" | "owner" | "current"> & {

package/dist/teams.js

@@ -8,6 +8,7 @@ import { ChatState } from "./chat-delivery-state.js";
 import { chatObject as object } from "./chat-delivery.js";
 import { loadTeamsCredentials, teamsAccessToken, teamsApi, verifyTeamsToken, TeamsError } from "./teams-api.js";
 import { deliverTeamsPart, planTeamsNotifications, planTeamsRooms, processTeamsEvent, receiveTeams } from "./teams-chat.js";
+import { limitWords } from "./request-budget.js";
 export const TEAMS_ACTIVITY_BYTES = 64 * 1024;
 export const TEAMS_MESSAGES_PATH = "/teams/messages";
 /** The receiver: prove the Bot Framework token for this app, save the activity, acknowledge. Nothing runs here. */
@@ -18,12 +19,26 @@ export async function handleTeamsHttp(request, response, options) {
     const reply = (status, body = "{}") => { response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" }); response.end(body); request.resume(); return true; };
     if (request.method !== "POST")
         return reply(405);
+    const refuseAdmission = (admitted) => {
+        if (admitted.ok)
+            return false;
+        if (admitted.status === 429)
+            response.setHeader("retry-after", String(admitted.retryAfter));
+        return reply(admitted.status, JSON.stringify({ error: admitted.status === 429 ? "rate-limited" : "limits-unavailable",
+            message: admitted.status === 429 ? limitWords(admitted.limit, admitted.retryAfter) : "Request limits could not be checked; nothing was saved." }));
+    };
+    // Source admission precedes JWT verification (including key fetches). Only proved app credentials consume
+    // the configured tenant's allowance; an untrusted activity cannot select or evade that allowance.
+    if (refuseAdmission(options.admitSource(request)))
+        return true;
     const credentials = loadTeamsCredentials(options.dir);
     if (credentials === null)
         return reply(404);
     const claims = await verifyTeamsToken(request.headers.authorization, credentials.app, options.fetcher ?? fetch);
     if (claims === null)
         return reply(401);
+    if (refuseAdmission(options.admitTenant(credentials.tenant)))
+        return true;
     if (Number(request.headers["content-length"] ?? 0) > TEAMS_ACTIVITY_BYTES)
         return reply(413);
     let raw = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.48",
+  "version": "0.9.49",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"