toolroll 0.9.48 → 0.9.50

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.9.50 — 2026-10-07
+
+- **One route policy table.** Every route's access rules live in one table,
+  checked before any handler runs. Undeclared routes are refused, approvals
+  are browser-only, and read tokens can't change anything.
+- **Server split by area.** The server code now lives in smaller modules.
+  No behaviour change for users.
+
+## 0.9.49 — 2026-10-07
+
+- **Tokens keep their limits.** A token's scope and project limits now hold
+  on every remote route.
+- **Browser login for step-ups.** Approvals and other password step-ups need
+  a browser login. OAuth refuses plain HTTP off loopback or your tailnet.
+- **Request budgets everywhere.** Budgets cover every remote route, and fake
+  account names can't lock anyone out.
+
 ## 0.9.48 — 2026-10-07
 
 - **Instant live views.** Changes reach open pages in about 2 ms (was about

package/dist/cli-http.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 import { contractRow, fileArguments, STEP_UP_MESSAGE } from './remote-command.js';
 import { limitWords } from './request-budget.js';
 /** Inlined file contents, summed as UTF-8 bytes. */
@@ -105,6 +106,8 @@ export async function handleCliHttp(request, response, options) {
         request.resume();
         return true;
     }
+    if (!adapterPolicy({ caller: "bearer", capability: principal.scope, token: true }).ok)
+        return reject(403, "read-only", "Your token reads only. Use an act token for this.");
     let value;
     try {
         value = await body(request);

package/dist/desktop-update.d.ts

@@ -94,20 +94,20 @@ export declare function prepareDesktopUpdate(stateDir: string, installed: string
 export declare function sqliteLock(file: string, busyTimeoutMs?: number): DatabaseSync | null;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    version?: never;
+    error?: never;
     active: boolean;
     phase: string;
     detail: string;
     running: boolean;
     canResume: boolean;
     canCancel: boolean;
-    error?: never;
     automaticRecovery?: never;
     recoveryAttempts?: never;
     recoveryRepairs?: never;
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
+    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/flow-triggers.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 /**
  * Flow triggers (v82): what starts cards in a flow without someone adding
  * them by hand.
@@ -944,6 +945,8 @@ export function receiveFlowHook(store, token, delivery, dir, now) {
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config === null || !takesDeliveries(config))
         return { status: 404, said: "No such address." };
+    if (!adapterPolicy({ caller: "service", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
+        return { status: 403, said: "No access to this flow." };
     if (delivery.body.length > HOOK_BYTES)
         return { status: 413, said: "Too large." };
     const note = (said) => { store.updateFlowTrigger(trigger.id, { lastAt: now.toISOString(), lastOutcome: said }, now); };
@@ -1069,6 +1072,8 @@ export function flowFormPage(store, token, now) {
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config?.kind !== "button")
         return { status: 404, html: formHtml("Not found", "<p>This form isn't available. Ask whoever shared it for a new link.</p>") };
+    if (!adapterPolicy({ caller: "anonymous", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
+        return { status: 403, html: "" };
     const fields = config.questions.map((question, index) => `<label>${esc(question)}${index === 0 ? `<input name="a${index}" required maxlength="200" autocomplete="off">` : `<textarea name="a${index}" maxlength="3000"></textarea>`}</label>`).join("");
     return { status: 200, html: formHtml(config.label, `<form method="post">${fields}<div class="trap" aria-hidden="true"><label>Leave this empty<input name="website" tabindex="-1" autocomplete="off"></label></div><input type="hidden" name="t" value="${now.getTime()}"><button>Send</button></form>`) };
 }
@@ -1078,6 +1083,8 @@ export function receiveFlowForm(store, token, fields, now) {
     const config = trigger === null ? null : triggerConfigOf(trigger);
     if (trigger === null || config?.kind !== "button")
         return flowFormPage(store, token, now);
+    if (!adapterPolicy({ caller: "anonymous", capability: "none" }, undefined, source => source === "flow" && store.getFlow(trigger.flow) !== null).ok)
+        return { status: 403, html: "" };
     const again = `<p><a href="${esc(FORM_PATH + token)}">Send another</a></p>`;
     const thanks = formHtml(config.label, `<p>Thanks — it's been sent.</p>${again}`);
     // A filled trap, or a page posted faster than a person could, gets thanks and makes nothing.

package/dist/mcp-http.d.ts

@@ -27,5 +27,6 @@ export type McpHttpOptions = {
     runAs?: RunOperateAs;
     /** A person token's request budget (request-budget.ts), charged once per request before its body is read. */
     admit?: (person: Person) => Admission;
+    requestBudgetClock?: () => number;
 };
 export declare function createMcpHttp(options: McpHttpOptions): (request: IncomingMessage, response: ServerResponse) => Promise<void>;

package/dist/mcp-http.js

@@ -1,25 +1,16 @@
-/**
- * The MCP gateway over streamable HTTP, served at /mcp by the console (serve.ts). Stateless: one JSON-RPC message per
- * POST, answered with one JSON body (a notification gets 202 and no body); there is no session and no event stream.
- * The modern revision carries its version in `_meta` as on stdio; a handshake-era client may initialize, and because
- * nothing is kept between requests its tools work without the stdio lifecycle.
- *
- * Every POST signs in again. The caller is a coordinator credential (the coordinator registry, exactly as on stdio) or
- * a person's own API token `so_…` (mcp-person.ts: their role, project grants and token scope). A password
- * (`name:password`) and cookies sign in nothing here, a request carrying a browser Origin is refused, and the console's
- * Host check runs before this route. A revoked or expired token answers 401 on its next request.
- */
+import { adapterPolicy } from "./server/route-policy.js";
 import { PACKAGE_VERSION } from "./version.js";
 import { parseApiToken, secretMatches, tokenLive, tokenProjects } from "./api-tokens.js";
 import { oauthProjects, oauthTokenAllowed, RESOURCE_PATH } from "./mcp-oauth.js";
 import { authenticateCoordinator } from "./coordinator.js";
 import { LEGACY, MAX_REQUEST, META_CAPABILITIES, META_SERVER, META_VERSION, MODERN, TOOLS, UNSUPPORTED_VERSION, callCoordinatorTool, capabilitiesShape, readMessage, shapeResult, toolsPayload, } from "./mcp-core.js";
 import { callPersonTool, personTools } from "./mcp-person.js";
-import { limitWords } from "./request-budget.js";
+import { limitWords, SOURCE_BUDGET_DEFAULTS, SourceAdmission } from "./request-budget.js";
 /** The most decisions a coordinator credential is remembered to have read (propose_answer needs one). */
 const READ_DECISIONS_KEPT = 200;
 export function createMcpHttp(options) {
     const { store } = options;
+    const coordinatorBudget = new SourceAdmission({ perMinute: SOURCE_BUDGET_DEFAULTS.coordinator, ...(options.requestBudgetClock === undefined ? {} : { clock: options.requestBudgetClock }) });
     /** Stdio remembers per connection which decisions a coordinator read; stateless HTTP remembers it per credential. */
     const readDecisions = new Map();
     const send = (response, status, body, headers = {}) => {
@@ -110,9 +101,10 @@ export function createMcpHttp(options) {
             const metadata = options.resourceMetadata?.(request) ?? null;
             return refuse(response, 401, "sign in with your API token (Authorization: Bearer so_…) or a coordinator credential — passwords and cookies are not accepted here", { "www-authenticate": `Bearer realm="toolroll-mcp"${metadata === null ? "" : `, resource_metadata="${metadata}"`}` });
         }
-        // A person's token is counted once per request, notifications included; a coordinator keeps its own proposal limit.
-        if (caller.kind === "person" && options.admit !== undefined) {
-            const admitted = options.admit(caller.person);
+        // Count every authenticated request once, including notifications. Coordinator proposal limits still apply
+        // separately inside tool transactions; this admission also bounds their reads and malformed requests.
+        {
+            const admitted = caller.kind === "person" ? options.admit?.(caller.person) ?? { ok: true } : coordinatorBudget.admit(caller.cid);
             if (!admitted.ok && admitted.status === 503)
                 return refuse(response, 503, "request limits could not be checked; nothing ran — try again shortly");
             if (!admitted.ok) {
@@ -120,6 +112,11 @@ export function createMcpHttp(options) {
                 return send(response, 429, { jsonrpc: "2.0", id: null, error: { code: -32000, message: limitWords(admitted.limit, admitted.retryAfter), data: { limit: admitted.limit, retryAfter: admitted.retryAfter } } }, { "retry-after": String(admitted.retryAfter) });
             }
         }
+        const policy = caller.kind === "coordinator"
+            ? adapterPolicy({ caller: "coordinator", capability: "act" })
+            : adapterPolicy({ caller: oauthProjects(store, caller.person.principal.tokenId) === null ? "bearer" : "oauth", capability: caller.person.principal.scope, token: true });
+        if (!policy.ok)
+            return refuse(response, 403, "this credential cannot call this route");
         if (!/^application\/json\s*(;|$)/i.test(request.headers["content-type"] ?? ""))
             return refuse(response, 415, "send the JSON-RPC message as application/json");
         if (Number(request.headers["content-length"] ?? 0) > MAX_REQUEST)

package/dist/mcp-oauth.d.ts

@@ -21,6 +21,7 @@
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Store } from "./store.js";
+import { type Admission } from "./request-budget.js";
 /** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
 export declare const OAUTH_TIMES: {
     readonly requestMs: number;
@@ -71,6 +72,8 @@ export type OAuthHttpOptions = {
     confirm: (session: OAuthSession, typed: string) => boolean;
     /** The projects this person may choose: each a project the server knows that they can use now. */
     projectsFor: (account: string) => string[];
+    /** The token exchange's budget by source (request-budget.ts): charged once per request, before its body is read or any code or refresh secret is spent. */
+    admitToken?: (request: IncomingMessage) => Admission;
 };
 /**
  * A redirect a client may register: https anywhere, or http on 127.0.0.1 / [::1] (RFC 8252 §7.3), with no

package/dist/mcp-oauth.js

@@ -1,26 +1,7 @@
-/**
- * MCP sign-in: OAuth 2.1 for /mcp, as the MCP authorization spec describes, so an engineer's MCP client connects
- * without a pasted token. This console is both the authorization server and the protected resource.
- *
- *   /mcp's 401 names /.well-known/oauth-protected-resource/mcp (RFC 9728), which names this console's
- *   /.well-known/oauth-authorization-server (RFC 8414). A client registers itself (RFC 7591, public clients only),
- *   sends the person to /oauth/authorize with a S256 PKCE challenge and resource=<origin>/mcp, and trades the code
- *   at /oauth/token for a short-lived access token and a refresh secret that rotates on every use.
- *
- * The person signs in with the console's own sign-in (password or identity provider, unchanged), then consents on
- * one page: read or act, and which of their projects, confirmed with their password or a fresh provider check, the
- * same step-up as making an API token. Nothing is granted without that form, its session CSRF value and a same-site
- * post.
- *
- * A grant is an ordinary API token (api-tokens.ts): its access token is `so_<id>_<secret>`, it is listed and revoked
- * with every other token (console Sessions & tokens, `toolroll tokens`), and /mcp runs it through the same person
- * path. Its v113 binding (store.oauthGrant) adds what an ordinary token doesn't have: it works only at /mcp, its
- * access secret lasts an hour, it is tied to the account generation that consented, and it reaches only the projects
- * chosen (still intersected with the person's live access on every call). Only hashes are kept: of codes, access
- * secrets and refresh secrets. Approvals, people and policy are never reachable: those have no tool and no scope.
- */
+import { adapterPolicy } from "./server/route-policy.js";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { hashSecret, mintApiToken } from "./api-tokens.js";
+import { limitWords } from "./request-budget.js";
 import { PKCE_CHALLENGE, readOAuthRegistration, readOAuthTokenRequest } from "./contracts/mcp-oauth.js";
 /** How long each piece lives. A code is spent at once; a grant ends after 30 days and the person consents again. */
 export const OAUTH_TIMES = { requestMs: 10 * 60_000, codeMs: 60_000, accessSeconds: 3600, grantDays: 30 };
@@ -338,6 +319,8 @@ export function createOAuthHttp(options) {
         // Never named back: a project outside the person's access is refused without saying whether it exists.
         if (!chosen.every(path => mine.includes(path)))
             return again(403, "Choose from your own projects.");
+        if (!adapterPolicy({ caller: "cookie", capability: account.role === "approver" ? "act" : "read", viewer: account.role === "viewer" }, "step-up", source => source === "none" && chosen.every(path => mine.includes(path))).ok)
+            return again(403, "Choose from your own projects.");
         if (!options.confirm(session, form.get("password") ?? ""))
             return again(403, "Enter your Toolroll password to allow access.");
         waiting.delete(id);
@@ -350,6 +333,13 @@ export function createOAuthHttp(options) {
     async function token(request, response, origin) {
         if (request.method !== "POST")
             return oauthError(response, 405, "invalid_request", "Use POST.");
+        const admitted = options.admitToken === undefined ? { ok: true } : options.admitToken(request);
+        if (!admitted.ok) {
+            request.resume();
+            if (admitted.status === 503)
+                return oauthError(response, 503, "temporarily_unavailable", "Request limits could not be checked; nothing was issued. Try again shortly.");
+            return json(response, 429, { error: "temporarily_unavailable", error_description: limitWords(admitted.limit, admitted.retryAfter) }, { "retry-after": String(admitted.retryAfter) });
+        }
         if (media(request) !== "application/x-www-form-urlencoded")
             return oauthError(response, 400, "invalid_request", "Send application/x-www-form-urlencoded.");
         const text = await readBody(request);
@@ -360,6 +350,8 @@ export function createOAuthHttp(options) {
             const unsupported = !("repeated" in read) && read.issues.some(one => one.path === "grant_type");
             return unsupported ? oauthError(response, 400, "unsupported_grant_type", "Use authorization_code or refresh_token.") : oauthError(response, 400, "invalid_request", "The token request isn't complete.");
         }
+        if (!adapterPolicy({ caller: "oauth", capability: "none" }).ok)
+            return oauthError(response, 403, "access_denied", "This credential cannot call this route.");
         const ask = read.value;
         const now = options.clock();
         const resource = `${origin}${RESOURCE_PATH}`;

package/dist/mcp-person.d.ts

@@ -1,12 +1,3 @@
-/**
- * A person's tools on the HTTP gateway. A person signs in with their own API token (api-tokens.ts) and every tool call
- * is the exact `toolroll` command line they could type, run on the server under their principal through
- * `runOperateAs` with source "mcp": the command's own authorization, project grants and attribution apply, and its
- * `--json` envelope is the answer. Nothing here reads data directly — a coordinator handler would skip the person's
- * project grants — and nothing here approves, answers or changes people or policy: those verbs have no tool.
- *
- * tools/list follows the account's role and the token's scope; dispatch checks again, independent of the list.
- */
 import { type PersonToolName } from "./contracts/gateway-tools.js";
 import { type CallOutcome, type Json } from "./mcp-core.js";
 import type { Store } from "./store.js";

package/dist/mcp-person.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 /**
  * A person's tools on the HTTP gateway. A person signs in with their own API token (api-tokens.ts) and every tool call
  * is the exact `toolroll` command line they could type, run on the server under their principal through
@@ -67,7 +68,7 @@ export async function callPersonTool(person, store, runAs, params) {
     const read = parseContract(PERSON_TOOL_INPUTS[tool], rawArgs);
     if (!read.ok)
         return { kind: "error", code: -32602, message: read.issues.map(one => one.line).join("; "), fatal: false };
-    if (!mayCall(person, tool)) {
+    if (!adapterPolicy({ caller: "bearer", capability: person.principal.scope, token: true }, TOOLS[tool].acts ? "act" : "read").ok || !mayCall(person, tool)) {
         const why = person.principal.scope === "read" ? "this token reads only — make an act token in the console to file work" : "your account can watch, not act";
         return refused(`${tool}: ${why}`);
     }

package/dist/operate.js

@@ -1,3 +1,4 @@
+import { adapterPolicy } from "./server/route-policy.js";
 import { UNSENT_REPLY_MS } from "./telegram-settings.js";
 import { checkPublicCommand } from "./public-check.js";
 import { leadNameOf } from "./lead-identity.js";
@@ -977,7 +978,7 @@ export async function runOperateAs(argv, opts) {
     // The parser's positionals must spell the same row (a value flag can't hide a subcommand).
     if (remoteRowOf(root, parsed.positional)?.invocation !== row.invocation)
         return refuse("not-remote", REMOTE_MESSAGES.unknown);
-    if (proved.scope === "read" && row.mutation !== "none")
+    if (!adapterPolicy({ caller: "bearer", capability: proved.scope, token: true }, row.mutation !== "none" ? "act" : "read").ok || proved.scope === "read" && row.mutation !== "none")
         return refuse("read-only", REMOTE_MESSAGES.read);
     if ([...parsed.flags.keys()].some(name => REMOTE_REFUSED_FLAGS.has(name)))
         return refuse("usage", REMOTE_MESSAGES.credential);
@@ -985,6 +986,8 @@ export async function runOperateAs(argv, opts) {
     const project = remoteProjectOf(store, { allows }, scope, parsed.positional, parsed.repoList, row.invocation, parsed.flags, opts.files ?? {});
     if (!project.ok)
         return refuse(project.reason, project.message);
+    if (!adapterPolicy({ caller: "bearer", capability: proved.scope, token: true }, undefined, source => source === "adapter" && (project.repo === null || allows(project.repo))).ok)
+        return refuse("forbidden", REMOTE_MESSAGES.no);
     // The local mutation cache has a global key namespace. A token must not use a chosen key to read
     // another person's/project's cached result. Revision keys already bind the actor and result in
     // task-outcome-cli.ts, which also validates their public 32-hex format; leave those intact.

package/dist/public-access.d.ts

@@ -42,7 +42,9 @@ export declare function transportOf(request: {
     forwardedProto: string | string[] | undefined;
     forwarded: string | string[] | undefined;
 }): Transport;
-/** Requests that carry, or exist to carry, an API token: the remote CLI, the MCP gateway, and any bearer credential. */
+/** The OAuth endpoints that hand out, consent to or take back a token (mcp-oauth.ts; revoke is reserved). Discovery stays public. */
+export declare const OAUTH_TOKEN_PATHS: ReadonlySet<string>;
+/** Requests that carry, or exist to carry, an API token: the remote CLI, the MCP gateway, MCP sign-in, and any bearer credential. */
 export declare function carriesToken(pathname: string, authorization: string | undefined): boolean;
 /** The refusal for a token sent over plain HTTP from outside this computer and the tailnet, else null. */
 export declare function plainHttpRefusal(transport: Transport, pathname: string, authorization: string | undefined): string | null;

package/dist/public-access.js

@@ -69,10 +69,14 @@ export function transportOf(request) {
         return { source: "unknown", https, privatePath: false };
     return { source, https, privatePath: isLoopbackPeer(source) || isTailnetAddress(source) };
 }
-/** Requests that carry, or exist to carry, an API token: the remote CLI, the MCP gateway, and any bearer credential. */
+/** The OAuth endpoints that hand out, consent to or take back a token (mcp-oauth.ts; revoke is reserved). Discovery stays public. */
+export const OAUTH_TOKEN_PATHS = new Set(["/oauth/authorize", "/oauth/token", "/oauth/register", "/oauth/revoke"]);
+/** Requests that carry, or exist to carry, an API token: the remote CLI, the MCP gateway, MCP sign-in, and any bearer credential. */
 export function carriesToken(pathname, authorization) {
     if (pathname === "/api/cli" || pathname.startsWith("/api/cli/") || pathname === "/mcp" || pathname.startsWith("/mcp/"))
         return true;
+    if (OAUTH_TOKEN_PATHS.has(pathname.replace(/\/+$/, "") || "/"))
+        return true;
     return authorization !== undefined && /^bearer\s/i.test(authorization);
 }
 /** The refusal for a token sent over plain HTTP from outside this computer and the tailnet, else null. */

package/dist/request-budget.d.ts

@@ -1,6 +1,6 @@
 /**
- * Request budgets for person API tokens (v112): how many requests one `so_` token may make to `/api/cli` and `/mcp`.
- * One budget per token, keyed by its api_token row id (never the secret, its name or an address), shared by both
+ * Request budgets for person API tokens (v112): how many requests one `so_` token may make across all accepting routes.
+ * One budget per token, keyed by its api_token row id (never the secret, its name or an address), shared by those
  * routes. A read token gets 120 requests in any sliding minute, an act token 30, and either 10,000 in a rolling day;
  * an instance operator may override any of these for the installation or for one token in the console (step-up).
  *
@@ -26,7 +26,7 @@ export declare const PER_DAY_MAX = 100000;
 export declare const TRACKED_TOKENS = 1024;
 export declare const FLUSH_MS = 5000;
 /** Which limit a refusal hit: the body of a 429 names only this and Retry-After. */
-export type BudgetLimit = "read-per-minute" | "act-per-minute" | "per-day";
+export type BudgetLimit = "read-per-minute" | "act-per-minute" | "per-day" | "per-minute";
 export type Admission = {
     ok: true;
 } | {
@@ -95,3 +95,30 @@ export declare class RequestBudget {
     /** The tracked entry (now the most recently used), from memory or as last saved; the least recently used is saved and let go. */
     private load;
 }
+/** Per-minute allowances for non-person-token identities and unauthenticated ingress. Password accounts get room
+ * for two-second follower polling plus ordinary commands; OAuth exchanges stay keyed by source address. */
+export declare const SOURCE_BUDGET_DEFAULTS: Readonly<{
+    password: 120;
+    oauthToken: 30;
+    coordinator: 120;
+    teamsSource: 120;
+    teamsTenant: 600;
+}>;
+/**
+ * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
+ * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ */
+export declare class SourceAdmission {
+    private readonly perMinute;
+    private readonly clock;
+    private readonly tracked;
+    private readonly usage;
+    constructor(options: {
+        perMinute: number;
+        clock?: () => number;
+        tracked?: number;
+    });
+    get size(): number;
+    admit(source: string): Admission;
+}

package/dist/request-budget.js

@@ -22,7 +22,7 @@ export const TRACKED_TOKENS = 1024;
 export const FLUSH_MS = 5_000;
 const MINUTE = 60_000, DAY = 86_400_000;
 /** The words for a 429, in one line. */
-export const limitWords = (limit, retryAfter) => `Request limit reached (${limit === "per-day" ? "requests per day" : limit === "read-per-minute" ? "read requests per minute" : "act requests per minute"}). Try again in ${retryAfter} second${retryAfter === 1 ? "" : "s"}.`;
+export const limitWords = (limit, retryAfter) => `Request limit reached (${limit === "per-day" ? "requests per day" : limit === "read-per-minute" ? "read requests per minute" : limit === "act-per-minute" ? "act requests per minute" : "requests per minute"}). Try again in ${retryAfter} second${retryAfter === 1 ? "" : "s"}.`;
 /** A limit typed into a form: a whole number within bounds, "" for none, or a problem. */
 export function parseLimit(raw, max) {
     const text = raw.trim();
@@ -231,3 +231,46 @@ export class RequestBudget {
         return usage;
     }
 }
+/** Per-minute allowances for non-person-token identities and unauthenticated ingress. Password accounts get room
+ * for two-second follower polling plus ordinary commands; OAuth exchanges stay keyed by source address. */
+export const SOURCE_BUDGET_DEFAULTS = Object.freeze({ password: 120, oauthToken: 30, coordinator: 120, teamsSource: 120, teamsTenant: 600 });
+/**
+ * A sliding minute per source or proved account, with bounded in-memory LRU history. Expired entries are
+ * pruned first; at capacity the least recently used entry is evicted so new callers are never globally locked out.
+ * Unverified account names must never be keys. Person API tokens use the persisted RequestBudget above.
+ */
+export class SourceAdmission {
+    perMinute;
+    clock;
+    tracked;
+    usage = new Map();
+    constructor(options) {
+        this.perMinute = Math.max(1, Math.min(PER_MINUTE_MAX, options.perMinute));
+        this.clock = options.clock ?? Date.now;
+        this.tracked = Math.max(1, options.tracked ?? TRACKED_TOKENS);
+    }
+    get size() { return this.usage.size; }
+    admit(source) {
+        const now = this.clock();
+        let times = this.usage.get(source);
+        if (times === undefined) {
+            if (this.usage.size >= this.tracked) {
+                for (const [key, kept] of this.usage)
+                    if (kept.every(at => at <= now - MINUTE))
+                        this.usage.delete(key);
+                if (this.usage.size >= this.tracked)
+                    this.usage.delete(this.usage.keys().next().value);
+            }
+            times = [];
+        }
+        this.usage.delete(source);
+        this.usage.set(source, times);
+        while (times.length > 0 && times[0] <= now - MINUTE)
+            times.shift();
+        if (times.length >= this.perMinute) {
+            return { ok: false, status: 429, limit: "per-minute", retryAfter: Math.max(1, Math.ceil((times[times.length - this.perMinute] + MINUTE - now) / 1000)) };
+        }
+        times.push(now);
+        return { ok: true };
+    }
+}