toolroll 0.9.54 → 0.9.55

package/dist/server/people-tokens.js

@@ -1,14 +1,17 @@
+import { handlersOf } from './handler-registry.js';
 import { adapterPolicy } from "./route-policy.js";
 /** settings handlers, moved without changing their route bodies. */
 import { mintApiToken, TOKEN_DAYS } from "../api-tokens.js";
 import { CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
-import { hiddenFields } from "../control-ui.js";
+import { html, htmlString, joinHtml, postForm } from "../html.js";
 import { credentialsHtml, tokenShownHtml } from "../credentials-ui.js";
 import { projectName } from "../project.js";
 import { requestLimitsHtml, tokenLimitWords } from "../request-budget-ui.js";
 import { authenticateAccount } from "../scope.js";
 import { SSO_CALLBACK } from "../sso-settings.js";
-import { escape, personChip, redirect, refuse, requestContext, respond, screen } from "./shared.js";
+import { requestContext } from "./request-context.js";
+import { personChip, refuse, screen } from "./chrome.js";
+import { redirect, respond } from "./http.js";
 /** people handlers, moved without changing their route bodies. */
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import {} from "node:http";
@@ -19,567 +22,571 @@ import { accessFromGroups, accountNameFor, exchangeOidcCode, newOidcVisit, oidcA
 import { personAuditHtml, personHref } from "../people-audit-ui.js";
 import { cursorOf as auditCursorOf, remoteAudit } from "../remote-audit.js";
 import { hashPassword } from "../scope.js";
-import { form, HANDOFF_STYLE, joinDeadPage, joinFormPage, loginHref, loginPage, loginReturn, page, SESSION_COOKIE, SIGN_IN_COOKIE, SIGN_IN_LINK_PATH, signInSpent, signupPage, startedHere } from "./shared.js";
+import { form, HANDOFF_STYLE, loginHref, loginReturn, page, SIGN_IN_COOKIE, signInSpent, startedHere } from "./http.js";
+import { joinDeadPage, joinFormPage, loginPage, signupPage } from "./render-people.js";
+import { SESSION_COOKIE, SIGN_IN_LINK_PATH } from "./session.js";
 export function createPeopleHandlers(runtime) {
     const { settingsUpdates, joinBySource, ssoOffer, ssoVisits, ssoSettings, options, clock, ssoHandoffs, managedRepos, store, visible, admissionList, sendScreen, chromeFor, restricted, sessions, consoleProjects, authenticateApprover, bustBadge, projectOf, signInLinks, linkKey, fromThisComputer, recordSignIn, passwordAllowed, arrival, defaultProject, cookieSecure, consoleOrigin, providerFor, joinSourceOf, signInBudget, signInActor, minutesWords } = runtime;
-    async function get(ctx) {
-        const { url, who, request, response, now, project, chosenProject, posted, route } = ctx;
-        // v101: Settings → Sessions & tokens: where you're signed in, and your API tokens. An instance operator can see everyone's.
-        if (url.pathname === "/settings/sessions") {
-            if (who.via !== "cookie")
-                return refuse(response, who, 403, "Sign in in a browser to see your sessions.", "/settings");
-            const everyone = url.searchParams.get("everyone") === "1" && store.isInstanceOperator(who.name);
-            const here = sessions.hashOf(who.session);
-            const view = { who: who.name, everyone, canSeeEveryone: store.isInstanceOperator(who.name), now: Date.now(),
-                sessions: store.webSessions(everyone ? null : who.name).map(one => ({ ...one, here: one.idHash === here })), tokens: store.apiTokens(everyone ? null : who.name),
-                limits: { note: tokenLimitWords.bind(null, store.handle), section: store.isInstanceOperator(who.name) ? requestLimitsHtml(store.handle, store.apiTokens(null), who.session.csrf, Date.now()) : "" } };
-            return sendScreen(response, 200, screen("Sessions & tokens", `<p><a href="/settings">Settings</a></p><h1>Sessions &amp; tokens</h1>${credentialsHtml(view, who.session.csrf, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
-        }
-        if (url.pathname === "/people") {
-            // People → a person: their API tokens and remote activity (people-audit-ui.ts). An approver may open anyone, within
-            // their projects; anyone else only themselves. Another person reads exactly like nobody.
-            const person = url.searchParams.get("person");
-            if (person !== null) {
-                const token = (url.searchParams.get("token-name") ?? "").slice(0, 60) || null, before = url.searchParams.get("before");
-                const cursor = before === null ? null : auditCursorOf(before);
-                if (before !== null && cursor === null)
-                    return refuse(response, who, 400, "Invalid activity cursor.", "/people");
-                const page = who.role === "approver" || person === who.name
-                    ? remoteAudit(store, { self: who.name, everyone: who.role === "approver", repos: admissionList(), unplaced: store.isInstanceOperator(who.name) }, { person, token, source: null, since: null }, { before: cursor })
-                    : null;
-                if (page === null || !page.ok)
-                    return refuse(response, who, 404, "No such person.", "/people");
-                return sendScreen(response, 200, screen("people", personAuditHtml({ name: person, tokens: store.apiTokens(person), actions: page.actions, token, nextCursor: page.nextCursor, now }), { chrome: chromeFor(project, "people") }));
-            }
-            // Approvers see everyone (D7's ceiling: every fact already passed
-            // the process admission); a viewer sees exactly themselves (U3).
-            if (restricted()) {
-                const projects = admissionList() ?? [];
-                return sendScreen(response, 200, screen("people", `<h1>Your access</h1><p>${personChip(who.name)} · ${who.role === "approver" ? "operator" : "viewer"}</p><p>${who.role === "approver" ? "You can create, manage, and approve work in these projects." : "You can read work in these projects."}</p><ul>${projects.map(repo => `<li>${escape(projectName(repo))}</li>`).join("")}</ul><p class="meta">An instance operator manages invitations and project access.</p><p><a href="${escape(personHref(who.name))}">Your remote activity</a></p>`, { chrome: chromeFor(project, "people") }));
-            }
-            const approverView = store.isInstanceOperator(who.name);
-            const accounts = store.accountFacts().filter(one => approverView || one.name === who.name);
-            const lastSeenOf = (name) => {
-                let seen = null;
-                for (const session of sessions.values()) {
-                    if (session.name === name && (seen === null || session.lastSeen > seen))
-                        seen = session.lastSeen;
-                }
-                return seen;
-            };
-            const csrf = who.via === "cookie" ? who.session.csrf : "";
-            const projectChoices = consoleProjects();
-            const accessFields = (selected) => `<label>Project access<select name="access"><option value="selected"${selected !== null ? " selected" : ""}>Selected projects</option><option value="all"${selected === null ? " selected" : ""}>All projects</option></select></label>` +
-                `<p class="meta">Operators with all-project access also manage the instance.</p><fieldset><legend>Projects</legend>${projectChoices.length === 0 ? `<p class="meta">Add a project before granting selected access.</p>` : projectChoices.map(repo => `<label class="row"><input type="checkbox" name="projects" value="${escape(repo)}"${selected?.includes(repo) ? " checked" : ""}>${escape(projectName(repo))}</label>`).join("")}</fieldset>`;
-            const cards = accounts.map(one => {
-                const seen = lastSeenOf(one.name);
-                const acts = store.recentActsOf(one.name);
-                const standing = one.revokedAt !== null
-                    ? `revoked ${escape(one.revokedAt.slice(0, 16).replace("T", " "))} by ${personChip(one.revokedBy ?? "?")}`
-                    : one.role === "approver"
-                        ? "approves"
-                        : "watches";
-                return [
-                    `<div class="card">`,
-                    `<h2 style="margin-top:0">${personChip(one.name)} <span class="meta">${standing}</span></h2>`,
-                    `<p class="meta">${one.projects === null ? "All projects" : one.projects.length === 0 ? "No project access" : one.projects.map(repo => escape(projectName(repo))).join(", ")}</p>`,
-                    approverView && one.revokedAt === null ? `<details><summary>Edit project access</summary><form method="post" action="/people/projects">${hiddenFields({ csrf, name: one.name })}${accessFields(one.projects)}<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><p class="meta">Changing access signs this person out and ends their derived sessions and modes. Previously approved work stays recorded.</p><button type="submit">Save project access</button></form></details>` : "",
-                    `<p class="meta">${seen === null ? "not signed in right now" : `signed in \u2014 active ${escape(new Date(seen).toISOString().slice(11, 16))} UTC`} \u00b7 joined ${escape(one.addedAt.slice(0, 10))}</p>`,
-                    `<p><a href="${escape(personHref(one.name))}">Tokens and remote activity</a></p>`,
-                    acts.length === 0
-                        ? `<p class="meta">No recorded acts yet</p>`
-                        : acts.map(act => `<p class="row meta">${escape(act.kind)} ${escape(act.subject)} \u00b7 ${escape(act.at.slice(0, 16).replace("T", " "))}</p>`).join("\n"),
-                    approverView && one.revokedAt === null && one.name !== who.name
-                        ? `<form method="post" action="/people/revoke" class="row">` +
-                            `<input type="hidden" name="csrf" value="${escape(csrf)}"><input type="hidden" name="name" value="${escape(one.name)}">` +
-                            `<label>Your password<input type="password" name="token" autocomplete="current-password"></label>` +
-                            `<button type="submit">Remove ${escape(one.name)}'s sign-in</button>` +
-                            `<span class="meta">ends their access and everything it signed \u2014 history stays</span></form>`
-                        : "",
-                    `</div>`,
-                ].join("\n");
-            });
-            const invites = approverView ? store.openInvites(now) : [];
-            const inviteRows = invites.map(one => `<p class="row">${escape(one.role)} invite · ${one.projects === null ? "all projects" : one.projects.map(repo => escape(projectName(repo))).join(", ")} \u00b7 from ${personChip(one.mintedBy)} \u00b7 expires ${escape(one.expiresAt.slice(0, 16).replace("T", " "))}${one.attempts > 0 ? ` \u00b7 ${one.attempts} failed attempt${one.attempts === 1 ? "" : "s"}` : ""}` +
-                ` <form method="post" action="/people/invite-revoke" style="display:inline">` +
-                `<input type="hidden" name="csrf" value="${escape(csrf)}"><input type="hidden" name="id" value="${one.id}">` +
-                `<label>Password <input type="password" name="token" autocomplete="current-password" style="width:8rem"></label>` +
-                `<button type="submit">Cancel it</button></form></p>`);
-            const inviteCard = !approverView
-                ? ""
-                : [
-                    `<div class="card">`,
-                    `<h2 style="margin-top:0">Invite someone</h2>`,
-                    inviteRows.length === 0 ? `<p class="meta">No open invites</p>` : inviteRows.join("\n"),
-                    `<form method="post" action="/people/invite" class="row">`,
-                    `<input type="hidden" name="csrf" value="${escape(csrf)}">`,
-                    `<label>They can<select name="role"><option value="viewer">Viewer — read work</option><option value="approver">Operator — create, manage and approve work</option></select></label>`,
+    // v101: Settings → Sessions & tokens: where you're signed in, and your API tokens. An instance operator can see everyone's.
+    async function sessionsPage(ctx) {
+        const { url, who, response, project } = ctx;
+        if (who.via !== "cookie")
+            return refuse(response, who, 403, "Sign in in a browser to see your sessions.", "/settings");
+        const everyone = url.searchParams.get("everyone") === "1" && store.isInstanceOperator(who.name);
+        const here = sessions.hashOf(who.session);
+        const view = { who: who.name, everyone, canSeeEveryone: store.isInstanceOperator(who.name), now: Date.now(),
+            sessions: store.webSessions(everyone ? null : who.name).map(one => ({ ...one, here: one.idHash === here })), tokens: store.apiTokens(everyone ? null : who.name),
+            limits: { note: tokenLimitWords.bind(null, store.handle), section: store.isInstanceOperator(who.name) ? requestLimitsHtml(store.handle, store.apiTokens(null), Date.now()) : html `` } };
+        return sendScreen(response, 200, screen("Sessions & tokens", html `<p><a href="/settings">Settings</a></p><h1>Sessions &amp; tokens</h1>${credentialsHtml(view, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}`, { chrome: chromeFor(project, "settings") }));
+    }
+    async function peoplePage(ctx) {
+        const { url, who, response, now, project } = ctx;
+        // People → a person: their API tokens and remote activity (people-audit-ui.ts). An approver may open anyone, within
+        // their projects; anyone else only themselves. Another person reads exactly like nobody.
+        const person = url.searchParams.get("person");
+        if (person !== null) {
+            const token = (url.searchParams.get("token-name") ?? "").slice(0, 60) || null, before = url.searchParams.get("before");
+            const cursor = before === null ? null : auditCursorOf(before);
+            if (before !== null && cursor === null)
+                return refuse(response, who, 400, "Invalid activity cursor.", "/people");
+            const page = who.role === "approver" || person === who.name
+                ? remoteAudit(store, { self: who.name, everyone: who.role === "approver", repos: admissionList(), unplaced: store.isInstanceOperator(who.name) }, { person, token, source: null, since: null }, { before: cursor })
+                : null;
+            if (page === null || !page.ok)
+                return refuse(response, who, 404, "No such person.", "/people");
+            return sendScreen(response, 200, screen("people", personAuditHtml({ name: person, tokens: store.apiTokens(person), actions: page.actions, token, nextCursor: page.nextCursor, now }), { chrome: chromeFor(project, "people") }));
+        }
+        // Approvers see everyone (D7's ceiling: every fact already passed
+        // the process admission); a viewer sees exactly themselves (U3).
+        if (restricted()) {
+            const projects = admissionList() ?? [];
+            return sendScreen(response, 200, screen("people", html `<h1>Your access</h1><p>${personChip(who.name)} · ${who.role === "approver" ? "operator" : "viewer"}</p><p>${who.role === "approver" ? "You can create, manage, and approve work in these projects." : "You can read work in these projects."}</p><ul>${projects.map(repo => html `<li>${projectName(repo)}</li>`)}</ul><p class="meta">An instance operator manages invitations and project access.</p><p><a href="${personHref(who.name)}">Your remote activity</a></p>`, { chrome: chromeFor(project, "people") }));
+        }
+        const approverView = store.isInstanceOperator(who.name);
+        const accounts = store.accountFacts().filter(one => approverView || one.name === who.name);
+        const lastSeenOf = (name) => {
+            let seen = null;
+            for (const session of sessions.values()) {
+                if (session.name === name && (seen === null || session.lastSeen > seen))
+                    seen = session.lastSeen;
+            }
+            return seen;
+        };
+        const projectChoices = consoleProjects();
+        const accessFields = (selected) => html `<label>Project access<select name="access"><option value="selected"${selected !== null ? " selected" : ""}>Selected projects</option><option value="all"${selected === null ? " selected" : ""}>All projects</option></select></label>\
+<p class="meta">Operators with all-project access also manage the instance.</p><fieldset><legend>Projects</legend>${projectChoices.length === 0 ? html `<p class="meta">Add a project before granting selected access.</p>` : projectChoices.map(repo => html `<label class="row"><input type="checkbox" name="projects" value="${repo}"${selected?.includes(repo) ? " checked" : ""}>${projectName(repo)}</label>`)}</fieldset>`;
+        const cards = accounts.map(one => {
+            const seen = lastSeenOf(one.name);
+            const acts = store.recentActsOf(one.name);
+            const standing = one.revokedAt !== null
+                ? html `revoked ${one.revokedAt.slice(0, 16).replace("T", " ")} by ${personChip(one.revokedBy ?? "?")}`
+                : one.role === "approver"
+                    ? "approves"
+                    : "watches";
+            return joinHtml([
+                html `<div class="card">`,
+                html `<h2 style="margin-top:0">${personChip(one.name)} <span class="meta">${standing}</span></h2>`,
+                html `<p class="meta">${one.projects === null ? "All projects" : one.projects.length === 0 ? "No project access" : one.projects.map(repo => projectName(repo)).join(", ")}</p>`,
+                approverView && one.revokedAt === null ? html `<details><summary>Edit project access</summary>${postForm("/people/projects", html `${accessFields(one.projects)}<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><p class="meta">Changing access signs this person out and ends their derived sessions and modes. Previously approved work stays recorded.</p><button type="submit">Save project access</button>`, { hidden: { name: one.name } })}</details>` : "",
+                html `<p class="meta">${seen === null ? "not signed in right now" : `signed in \u2014 active ${new Date(seen).toISOString().slice(11, 16)} UTC`} \u00b7 joined ${one.addedAt.slice(0, 10)}</p>`,
+                html `<p><a href="${personHref(one.name)}">Tokens and remote activity</a></p>`,
+                acts.length === 0
+                    ? html `<p class="meta">No recorded acts yet</p>`
+                    : joinHtml(acts.map(act => html `<p class="row meta">${act.kind} ${act.subject} \u00b7 ${act.at.slice(0, 16).replace("T", " ")}</p>`), "\n"),
+                approverView && one.revokedAt === null && one.name !== who.name
+                    ? postForm("/people/revoke", html `\
+<label>Your password<input type="password" name="token" autocomplete="current-password"></label>\
+<button type="submit">Remove ${one.name}'s sign-in</button>\
+<span class="meta">ends their access and everything it signed \u2014 history stays</span>`, { attrs: { class: "row" }, hidden: { name: one.name } })
+                    : "",
+                html `</div>`,
+            ], "\n");
+        });
+        const invites = approverView ? store.openInvites(now) : [];
+        const inviteRows = invites.map(one => html `<p class="row">${one.role} invite · ${one.projects === null ? "all projects" : one.projects.map(repo => projectName(repo)).join(", ")} \u00b7 from ${personChip(one.mintedBy)} \u00b7 expires ${one.expiresAt.slice(0, 16).replace("T", " ")}${one.attempts > 0 ? ` \u00b7 ${one.attempts} failed attempt${one.attempts === 1 ? "" : "s"}` : ""}\
+ ${postForm("/people/invite-revoke", html `\
+<label>Password <input type="password" name="token" autocomplete="current-password" style="width:8rem"></label>\
+<button type="submit">Cancel it</button>`, { attrs: { style: "display:inline" }, hidden: { id: one.id } })}</p>`);
+        const inviteCard = !approverView
+            ? ""
+            : joinHtml([
+                html `<div class="card">`,
+                html `<h2 style="margin-top:0">Invite someone</h2>`,
+                inviteRows.length === 0 ? html `<p class="meta">No open invites</p>` : joinHtml(inviteRows, "\n"),
+                postForm("/people/invite", joinHtml([
+                    "",
+                    html `<label>They can<select name="role"><option value="viewer">Viewer — read work</option><option value="approver">Operator — create, manage and approve work</option></select></label>`,
                     accessFields(project === null ? [] : [project]),
-                    `<label>Your password<input type="password" name="token" autocomplete="current-password"></label>`,
-                    `<button type="submit">Make an invite link</button>`,
-                    `<span class="meta">single-use, expires in 72 hours</span>`,
-                    `</form>`,
-                    `</div>`,
-                ].join("\n");
-            // Coordinators (MCP spec v6): the machine principals beside the
-            // human ones — name, immutable fingerprint, what they may file
-            // into, their rate, and the revoke road. Approver eyes only.
-            const coordinatorCard = !approverView
-                ? ""
-                : (() => {
-                    const rows = listCoordinators(store);
-                    if (rows.length === 0)
-                        return "";
-                    return [
-                        `<div class="card">`,
-                        `<h2 style="margin-top:0">Agent filers</h2>`,
-                        `<p class="meta">Agents that can propose tasks. You approve what runs.</p>`,
-                        ...rows.map(one => `<p class="row">` +
-                            `<span class="mono">${escape(`${one.name}#${one.cid.slice(0, 4)}`)}</span> ` +
-                            (one.revokedAt !== null
-                                ? `<span class="meta">revoked ${escape(one.revokedAt.slice(0, 10))}</span>`
-                                : `<span class="meta">${one.perHour}/hour · files into ${one.repos.map(repo => escape(repo)).join(", ")} · ${one.expiresAt === null ? "no expiry (made before expiry)" : `expires ${escape(one.expiresAt.slice(0, 10))}`} · last filed ${one.lastFiledAt === null ? "never" : escape(one.lastFiledAt.slice(0, 16).replace("T", " "))}</span>`) +
-                            `</p>`),
-                        `<details class="settings-more"><summary>Revoke an agent filer</summary><p class="meta">Run <code>toolroll coordinator revoke &lt;cid&gt; --as you</code> on this computer.</p></details>`,
-                        `</div>`,
-                    ].join("\n");
-                })();
-            return sendScreen(response, 200, screen("people", [`<h1>People</h1>`, ...cards, coordinatorCard, inviteCard].join("\n"), {
-                chrome: chromeFor(project, "people"),
-            }));
-        }
-        return refuse(response, who, 404, "There's no page at this address.", "/chat");
+                    html `<label>Your password<input type="password" name="token" autocomplete="current-password"></label>`,
+                    html `<button type="submit">Make an invite link</button>`,
+                    html `<span class="meta">single-use, expires in 72 hours</span>`,
+                ], "\n"), { attrs: { class: "row" } }),
+                html `</div>`,
+            ], "\n");
+        // Coordinators (MCP spec v6): the machine principals beside the
+        // human ones — name, immutable fingerprint, what they may file
+        // into, their rate, and the revoke road. Approver eyes only.
+        const coordinatorCard = !approverView
+            ? ""
+            : (() => {
+                const rows = listCoordinators(store);
+                if (rows.length === 0)
+                    return "";
+                return joinHtml([
+                    html `<div class="card">`,
+                    html `<h2 style="margin-top:0">Agent filers</h2>`,
+                    html `<p class="meta">Agents that can propose tasks. You approve what runs.</p>`,
+                    ...rows.map(one => html `<p class="row"><span class="mono">${`${one.name}#${one.cid.slice(0, 4)}`}</span> ${one.revokedAt !== null
+                        ? html `<span class="meta">revoked ${one.revokedAt.slice(0, 10)}</span>`
+                        : html `<span class="meta">${one.perHour}/hour · files into ${one.repos.join(", ")} · ${one.expiresAt === null ? "no expiry (made before expiry)" : `expires ${one.expiresAt.slice(0, 10)}`} · last filed ${one.lastFiledAt === null ? "never" : one.lastFiledAt.slice(0, 16).replace("T", " ")}</span>`}</p>`),
+                    html `<details class="settings-more"><summary>Revoke an agent filer</summary><p class="meta">Run <code>toolroll coordinator revoke &lt;cid&gt; --as you</code> on this computer.</p></details>`,
+                    html `</div>`,
+                ], "\n");
+            })();
+        return sendScreen(response, 200, screen("people", joinHtml([html `<h1>People</h1>`, ...cards, coordinatorCard, inviteCard], "\n"), {
+            chrome: chromeFor(project, "people"),
+        }));
     }
-    async function post(ctx) {
-        const { url, who, request, response, now, project, chosenProject, posted, route } = ctx;
-        if (url.pathname === "/settings/sessions") {
-            const body = readForm(posted, CONSOLE_FORMS.sessions);
-            if (who.via !== "cookie")
-                return refuse(response, who, 403, "Sign in in a browser to manage sessions and tokens.", "/settings");
-            const operator = store.isInstanceOperator(who.name);
-            const back = (key, words) => redirect(response, `/settings/sessions?${body.get("everyone") === "1" && operator ? "everyone=1&" : ""}${key}=${encodeURIComponent(words)}`);
-            const action = body.get("action") ?? "";
-            if (action === "end-session") {
-                const target = store.webSessions(null).find(one => one.idHash === (body.get("session") ?? ""));
-                if (target === undefined)
-                    return back("problem", "That session has already ended.");
-                if (target.account !== who.name && !operator)
-                    return refuse(response, who, 403, "You can end only your own sessions.", "/settings/sessions");
-                sessions.endByHash(target.idHash);
-                recordSignIn(target.account, "signed out", target.account === who.name ? "by you elsewhere" : `by ${who.name}`);
-                return back("said", "Signed out there.");
-            }
-            if (action === "end-others") {
-                const here = sessions.hashOf(who.session);
-                const others = store.webSessions(who.name).filter(one => one.idHash !== here);
-                for (const one of others)
-                    sessions.endByHash(one.idHash);
-                if (others.length > 0)
-                    recordSignIn(who.name, "signed out", `everywhere else (${others.length})`);
-                return back("said", others.length === 0 ? "You aren't signed in anywhere else." : `Signed out of ${others.length} other session${others.length === 1 ? "" : "s"}.`);
-            }
-            if (action === "revoke-token") {
-                const token = store.apiTokens(null).find(one => one.id === (body.get("token") ?? ""));
-                if (token === undefined || token.revokedAt !== null)
-                    return back("problem", "That token was already revoked.");
-                if (token.account !== who.name && !operator)
-                    return refuse(response, who, 403, "You can revoke only your own tokens.", "/settings/sessions");
-                store.revokeApiToken(token.id, who.name, now);
-                return back("said", `Revoked ${token.name}. Anything using it stops working now.`);
-            }
-            if (action === "create-token") {
-                const name = (body.get("name") ?? "").trim().replace(/[\u0000-\u001f\u007f]+/g, " ");
-                const access = body.get("access") === "act" ? "act" : "read";
-                const days = Number(body.get("days"));
-                if (name === "" || name.length > 60)
-                    return back("problem", "Name the token, in 60 characters or fewer.");
-                if (!TOKEN_DAYS.includes(days))
-                    return back("problem", "Choose when it expires.");
-                if (access === "act" && who.role !== "approver")
-                    return back("problem", "A viewer's token can only read.");
-                // A token is a credential: made with the person's password (or their identity provider's check from moments ago), counted once.
-                const typed = body.get("password") ?? "";
-                const confirmed = who.role === "approver" ? authenticateApprover(who, typed).ok
-                    : typed === "" ? requestContext.getStore()?.sso?.fresh === true : authenticateAccount(store, who.name, typed).ok;
-                if (!confirmed)
-                    return back("problem", "Enter your Toolroll password to make a token.");
-                const minted = mintApiToken();
-                const expiresAt = new Date(now.getTime() + days * 86_400_000).toISOString();
-                store.createApiToken({ id: minted.id, account: who.name, name, secretHash: minted.hash, access, expiresAt, by: who.name }, now);
-                // The token, once, on a page with no script.
-                return sendScreen(response, 200, screen("API token", tokenShownHtml(name, minted.token, access, expiresAt), { chrome: chromeFor(projectOf(who, request) ?? null, "settings"), forceSensitive: true }));
-            }
-            return back("problem", "Choose an action.");
-        }
-        if (url.pathname === "/people/projects") {
-            const body = readForm(posted, CONSOLE_FORMS.peopleProjects);
-            if (who.via !== "cookie" || !store.isInstanceOperator(who.name))
-                return refuse(response, who, 403, "An instance operator manages project access.", "/people");
-            if (!authenticateApprover(who, body.get("token") ?? "", null).ok)
-                return refuse(response, who, 403, "Saving access requires your password.", "/people");
-            const access = readAccessForm(body);
-            if (!access.ok)
-                return refuse(response, who, 400, access.message, "/people");
-            const changed = store.setAccountProjects((body.get("name") ?? "").trim(), access.projects, who.name, now);
-            if (!changed.ok)
-                return refuse(response, who, 409, changed.reason === "last-instance-operator" ? "Keep at least one instance operator with all-project access." : "That account cannot be changed.", "/people");
-            bustBadge();
-            return redirect(response, "/people?said=Project%20access%20saved");
-        }
-        if (url.pathname === "/people/invite") {
-            const body = readForm(posted, CONSOLE_FORMS.peopleInvite);
-            if (who.via !== "cookie")
-                return refuse(response, who, 403, "inviting is a browser surface");
-            const token = body.get("token") ?? "";
-            // RAISING authority is a password ceremony (the doctrine): adding a
-            // person to the instance is exactly that.
-            if (!authenticateApprover(who, token).ok) {
-                return refuse(response, who, 403, "making an invite takes your password, typed again", "/people");
-            }
-            const role = body.get("role") === "approver" ? "approver" : "viewer";
-            const access = readAccessForm(body);
-            if (!access.ok)
-                return refuse(response, who, 400, access.message, "/people");
-            if (access.projects !== null && access.projects.length === 0)
-                return refuse(response, who, 400, "Select at least one project for this invitation.", "/people");
-            const minted = store.mintInvite(role, who.name, now, undefined, access.projects);
-            const origin = options.publicUrl !== undefined ? options.publicUrl.replace(/\/$/, "") : `http://${request.headers.host ?? "this-console"}`;
-            const linkScreen = screen("people", [
-                `<h1>Invite link</h1>`,
-                `<div class="card">`,
-                `<p>Shown once, so copy it now.</p>`,
-                `<p class="mono secret-value">${escape(`${origin}/join/${minted.token}`)}</p>`,
-                `<p class="meta">Send it to one person. It works once, lets them ${role === "approver" ? "approve and act" : "read work"} in ${access.projects === null ? "all projects" : access.projects.map(repo => escape(projectName(repo))).join(", ")}, and expires ${escape(minted.expiresAt.slice(0, 16).replace("T", " "))} UTC. Cancel it any time on People.</p>`,
-                `</div>`,
-                `<p class="meta"><a href="/people">Back to People</a></p>`,
-            ].join("\n"), 
-            // A one-time secret on screen: no script of any kind rides along.
-            { chrome: chromeFor(projectOf(who, request) ?? null, "people"), forceSensitive: true });
-            return sendScreen(response, 200, linkScreen);
-        }
-        if (url.pathname === "/people/invite-revoke") {
-            const body = readForm(posted, CONSOLE_FORMS.peopleInviteRevoke);
-            if (who.via !== "cookie")
-                return refuse(response, who, 403, "inviting is a browser surface");
-            const token = body.get("token") ?? "";
-            if (!authenticateApprover(who, token).ok) {
-                return refuse(response, who, 403, "cancelling an invite takes your password, typed again", "/people");
-            }
-            const id = Number(body.get("id") ?? "");
-            const revoked = Number.isInteger(id) && id > 0 && store.revokeInvite(id, now);
-            return redirect(response, `/people?said=${encodeURIComponent(revoked ? "the invite is cancelled — its link is dead" : "that invite was already gone")}`);
-        }
-        if (url.pathname === "/people/revoke") {
-            const body = readForm(posted, CONSOLE_FORMS.peopleRevoke);
-            if (who.via !== "cookie")
-                return refuse(response, who, 403, "removing a person is a browser surface");
-            const token = body.get("token") ?? "";
-            if (!authenticateApprover(who, token).ok) {
-                return refuse(response, who, 403, "removing a person takes your password, typed again", "/people");
-            }
-            const name = (body.get("name") ?? "").trim();
-            const severed = store.revokeAccount(name, who.name, now);
-            if (!severed.ok) {
-                const words = severed.reason === "last-approver"
-                    ? "that is the last account that can approve — add another approver first"
-                    : severed.reason === "already-revoked"
-                        ? `${name} is already removed`
-                        : `no account \u0060${name}\u0060`;
-                return refuse(response, who, severed.reason === "last-approver" ? 409 : 404, words, "/people");
-            }
-            return redirect(response, `/people?said=${encodeURIComponent(`${name} can no longer sign in — their sessions, invites, and signed modes ended with them; history stays`)}`);
+    async function sessionsSend(ctx) {
+        const { who, request, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.sessions);
+        if (who.via !== "cookie")
+            return refuse(response, who, 403, "Sign in in a browser to manage sessions and tokens.", "/settings");
+        const operator = store.isInstanceOperator(who.name);
+        const back = (key, words) => redirect(response, `/settings/sessions?${body.get("everyone") === "1" && operator ? "everyone=1&" : ""}${key}=${encodeURIComponent(words)}`);
+        const action = body.get("action") ?? "";
+        if (action === "end-session") {
+            const target = store.webSessions(null).find(one => one.idHash === (body.get("session") ?? ""));
+            if (target === undefined)
+                return back("problem", "That session has already ended.");
+            if (target.account !== who.name && !operator)
+                return refuse(response, who, 403, "You can end only your own sessions.", "/settings/sessions");
+            sessions.endByHash(target.idHash);
+            recordSignIn(target.account, "signed out", target.account === who.name ? "by you elsewhere" : `by ${who.name}`);
+            return back("said", "Signed out there.");
+        }
+        if (action === "end-others") {
+            const here = sessions.hashOf(who.session);
+            const others = store.webSessions(who.name).filter(one => one.idHash !== here);
+            for (const one of others)
+                sessions.endByHash(one.idHash);
+            if (others.length > 0)
+                recordSignIn(who.name, "signed out", `everywhere else (${others.length})`);
+            return back("said", others.length === 0 ? "You aren't signed in anywhere else." : `Signed out of ${others.length} other session${others.length === 1 ? "" : "s"}.`);
+        }
+        if (action === "revoke-token") {
+            const token = store.apiTokens(null).find(one => one.id === (body.get("token") ?? ""));
+            if (token === undefined || token.revokedAt !== null)
+                return back("problem", "That token was already revoked.");
+            if (token.account !== who.name && !operator)
+                return refuse(response, who, 403, "You can revoke only your own tokens.", "/settings/sessions");
+            store.revokeApiToken(token.id, who.name, now);
+            return back("said", `Revoked ${token.name}. Anything using it stops working now.`);
+        }
+        if (action === "create-token") {
+            const name = (body.get("name") ?? "").trim().replace(/[\u0000-\u001f\u007f]+/g, " ");
+            const access = body.get("access") === "act" ? "act" : "read";
+            const days = Number(body.get("days"));
+            if (name === "" || name.length > 60)
+                return back("problem", "Name the token, in 60 characters or fewer.");
+            if (!TOKEN_DAYS.includes(days))
+                return back("problem", "Choose when it expires.");
+            if (access === "act" && who.role !== "approver")
+                return back("problem", "A viewer's token can only read.");
+            // A token is a credential: made with the person's password (or their identity provider's check from moments ago), counted once.
+            const typed = body.get("password") ?? "";
+            const confirmed = who.role === "approver" ? authenticateApprover(who, typed).ok
+                : typed === "" ? requestContext.getStore()?.sso?.fresh === true : authenticateAccount(store, who.name, typed).ok;
+            if (!confirmed)
+                return back("problem", "Enter your Toolroll password to make a token.");
+            const minted = mintApiToken();
+            const expiresAt = new Date(now.getTime() + days * 86_400_000).toISOString();
+            store.createApiToken({ id: minted.id, account: who.name, name, secretHash: minted.hash, access, expiresAt, by: who.name }, now);
+            // The token, once, on a page with no script.
+            return sendScreen(response, 200, screen("API token", tokenShownHtml(name, minted.token, access, expiresAt), { chrome: chromeFor(projectOf(who, request) ?? null, "settings"), forceSensitive: true }));
         }
-        return refuse(response, who, 404, "There's no page at this address.", "/chat");
+        return back("problem", "Choose an action.");
     }
-    async function edge(ctx) {
-        const { url, who, request, response, method } = ctx;
-        if (url.pathname === "/login" && method === "GET") {
-            if (options.setupCode !== undefined && store.listApprovers().length === 0) {
-                return page(response, 200, signupPage(null, runtime.setupAttemptsLeft));
-            }
-            return page(response, 200, loginPage(null, loginReturn(url.searchParams.get("return")), ssoOffer()));
-        }
-        // The one-time link `up` opens (onboarding): it signs the browser on this computer in and lands on Chat. Spent on
-        // the first visit whatever happens; the ledger notes the sign-in, never the link.
-        if (url.pathname.startsWith(SIGN_IN_LINK_PATH) && method === "GET") {
-            const code = url.pathname.slice(SIGN_IN_LINK_PATH.length);
-            const held = /^[A-Za-z0-9_-]{43}$/.test(code) ? signInLinks.get(linkKey(code)) : undefined;
-            if (held !== undefined)
-                signInLinks.delete(linkKey(code));
-            response.setHeader("Referrer-Policy", "no-referrer");
-            if (!fromThisComputer(request)) {
-                recordSignIn(held?.account ?? "unknown account", "sign-in refused", "one-time link", "opened from another device");
-                return page(response, 403, loginPage("That sign-in link works only in a browser on the computer running Toolroll. Sign in with your password.", "/chat", ssoOffer()));
-            }
-            if (held === undefined || held.expires < Date.now()) {
-                return page(response, 410, loginPage("That sign-in link has been used or has expired. Sign in with your password, or run toolroll up again.", "/chat", ssoOffer()));
-            }
-            const account = store.accountOf(held.account);
-            if (account === null || account.role !== "approver" || account.revokedAt !== null)
-                return page(response, 403, loginPage("That account can't sign in here any more.", "/chat", ssoOffer()));
-            if (!passwordAllowed(held.account))
-                return page(response, 403, loginPage(`Sign in with ${ssoSettings()?.label ?? "your identity provider"}.`, "/chat", ssoOffer()));
-            const id = randomBytes(32).toString("hex");
-            sessions.set(id, { ...arrival(request), name: held.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
-                project: defaultProject, projectRevision: 1 });
-            recordSignIn(held.account, "signed in", "one-time link");
-            response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
-            return redirect(response, "/chat");
-        }
-        // v100: sign-in with the identity provider. ?reauth=1 asks it to check the person again (a step-up);
-        // ?link=1 links the signed-in account to it. The browser that starts it holds the visit's state.
-        if (url.pathname === "/login/sso" && method === "GET") {
-            const settings = ssoSettings();
-            const intent = url.searchParams.get("link") === "1" ? "link" : url.searchParams.get("reauth") === "1" ? "reauth" : "sign-in";
-            const returnTo = loginReturn(url.searchParams.get("return"));
-            if (settings === null)
-                return page(response, 404, loginPage("Sign-in with an identity provider isn't on.", returnTo));
-            if (intent !== "sign-in" && who?.via !== "cookie")
-                return redirect(response, loginHref(returnTo));
-            const origin = consoleOrigin(request.headers.host);
-            if (origin === null)
-                return page(response, 400, loginPage("Sign in from this computer (localhost) or from your https address.", returnTo, ssoOffer()));
-            const found = await providerFor(settings.issuer);
-            if (!found.ok)
-                return page(response, 502, loginPage(`${settings.label} isn't answering: ${found.said}`, returnTo, ssoOffer()));
-            const visit = newOidcVisit(), redirectUri = `${origin}${SSO_CALLBACK}`;
-            for (const [key, one] of ssoVisits)
-                if (one.expires < Date.now())
-                    ssoVisits.delete(key);
-            // Bounded: anyone may start a sign-in, so the oldest waiting ones give way.
-            while (ssoVisits.size >= 1000)
-                ssoVisits.delete(ssoVisits.keys().next().value);
-            ssoVisits.set(visit.state, { visit, provider: found.provider, redirect: redirectUri, intent, returnTo, expires: Date.now() + 15 * 60_000 });
-            response.writeHead(302, { location: oidcAuthorizeUrl(found.provider, settings, visit, redirectUri, intent === "reauth"), "cache-control": "no-store", "referrer-policy": "no-referrer",
-                "set-cookie": `${SIGN_IN_COOKIE}=${visit.state}; Path=${SSO_CALLBACK}; Max-Age=900; HttpOnly; SameSite=Lax${origin.startsWith("https:") ? "; Secure" : ""}` });
-            response.end();
-            return;
-        }
-        if (url.pathname === SSO_CALLBACK && method === "GET")
-            return ssoCallback(request, response, url);
-        if (url.pathname === "/login/sso/finish" && method === "GET") {
-            const key = url.searchParams.get("h") ?? "";
-            if (!startedHere(request, key))
-                return page(response, 400, loginPage("That sign-in was started in another browser. Sign in again from this one.", "/", ssoOffer()));
-            const handoff = ssoHandoffs.get(key);
-            ssoHandoffs.delete(key);
-            response.setHeader("Set-Cookie", signInSpent("/login/sso/finish"));
-            const settings = ssoSettings();
-            if (handoff === undefined || handoff.expires < Date.now() || settings === null)
-                return page(response, 400, loginPage("That sign-in expired. Try again.", "/", ssoOffer()));
-            const { claims } = handoff;
-            const identity = { issuer: handoff.issuer, subject: claims.sub, email: claims.email, label: settings.label };
-            if (handoff.intent === "link" || handoff.intent === "reauth") {
-                if (who?.via !== "cookie")
-                    return redirect(response, loginHref(handoff.returnTo));
-                if (handoff.intent === "link") {
-                    const linked = store.linkSsoIdentity(who.name, identity, clock());
-                    if (!linked.ok)
-                        return redirect(response, `/settings/sign-in?problem=${encodeURIComponent(`That ${settings.label} account signs in as someone else here.`)}`);
-                    who.session.sso = { at: Date.now() };
-                    sessions.persist(who.session);
-                    return redirect(response, `/settings/sign-in?said=${encodeURIComponent(`This account signs in with ${settings.label} now.`)}`);
-                }
-                // A step-up: the provider checked the same person again.
-                if (store.ssoAccount(identity.issuer, identity.subject) !== who.name)
-                    return page(response, 403, loginPage(`That ${settings.label} account isn't the one signed in here.`, handoff.returnTo, ssoOffer()));
+    async function peopleProjects(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.peopleProjects);
+        if (!authenticateApprover(who, body.get("token") ?? "", null).ok)
+            return refuse(response, who, 403, "Saving access requires your password.", "/people");
+        const access = readAccessForm(body);
+        if (!access.ok)
+            return refuse(response, who, 400, access.message, "/people");
+        const changed = store.setAccountProjects((body.get("name") ?? "").trim(), access.projects, who.name, now);
+        if (!changed.ok)
+            return refuse(response, who, 409, changed.reason === "last-instance-operator" ? "Keep at least one instance operator with all-project access." : "That account cannot be changed.", "/people");
+        bustBadge();
+        return redirect(response, "/people?said=Project%20access%20saved");
+    }
+    async function peopleInvite(ctx) {
+        const { who, request, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.peopleInvite);
+        if (who.via !== "cookie")
+            return refuse(response, who, 403, "inviting is a browser surface");
+        const token = body.get("token") ?? "";
+        // RAISING authority is a password ceremony (the doctrine): adding a
+        // person to the instance is exactly that.
+        if (!authenticateApprover(who, token).ok) {
+            return refuse(response, who, 403, "making an invite takes your password, typed again", "/people");
+        }
+        const role = body.get("role") === "approver" ? "approver" : "viewer";
+        const access = readAccessForm(body);
+        if (!access.ok)
+            return refuse(response, who, 400, access.message, "/people");
+        if (access.projects !== null && access.projects.length === 0)
+            return refuse(response, who, 400, "Select at least one project for this invitation.", "/people");
+        const minted = store.mintInvite(role, who.name, now, undefined, access.projects);
+        const origin = options.publicUrl !== undefined ? options.publicUrl.replace(/\/$/, "") : `http://${request.headers.host ?? "this-console"}`;
+        const linkScreen = screen("people", joinHtml([
+            html `<h1>Invite link</h1>`,
+            html `<div class="card">`,
+            html `<p>Shown once, so copy it now.</p>`,
+            html `<p class="mono secret-value">${`${origin}/join/${minted.token}`}</p>`,
+            html `<p class="meta">Send it to one person. It works once, lets them ${role === "approver" ? "approve and act" : "read work"} in ${access.projects === null ? "all projects" : access.projects.map(repo => projectName(repo)).join(", ")}, and expires ${minted.expiresAt.slice(0, 16).replace("T", " ")} UTC. Cancel it any time on People.</p>`,
+            html `</div>`,
+            html `<p class="meta"><a href="/people">Back to People</a></p>`,
+        ], "\n"), 
+        // A one-time secret on screen: no script of any kind rides along.
+        { chrome: chromeFor(projectOf(who, request) ?? null, "people"), forceSensitive: true });
+        return sendScreen(response, 200, linkScreen);
+    }
+    async function peopleInviteRevoke(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.peopleInviteRevoke);
+        if (who.via !== "cookie")
+            return refuse(response, who, 403, "inviting is a browser surface");
+        const token = body.get("token") ?? "";
+        if (!authenticateApprover(who, token).ok) {
+            return refuse(response, who, 403, "cancelling an invite takes your password, typed again", "/people");
+        }
+        const id = Number(body.get("id") ?? "");
+        const revoked = Number.isInteger(id) && id > 0 && store.revokeInvite(id, now);
+        return redirect(response, `/people?said=${encodeURIComponent(revoked ? "the invite is cancelled — its link is dead" : "that invite was already gone")}`);
+    }
+    async function peopleRevoke(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.peopleRevoke);
+        if (who.via !== "cookie")
+            return refuse(response, who, 403, "removing a person is a browser surface");
+        const token = body.get("token") ?? "";
+        if (!authenticateApprover(who, token).ok) {
+            return refuse(response, who, 403, "removing a person takes your password, typed again", "/people");
+        }
+        const name = (body.get("name") ?? "").trim();
+        const severed = store.revokeAccount(name, who.name, now);
+        if (!severed.ok) {
+            const words = severed.reason === "last-approver"
+                ? "that is the last account that can approve — add another approver first"
+                : severed.reason === "already-revoked"
+                    ? `${name} is already removed`
+                    : `no account \u0060${name}\u0060`;
+            return refuse(response, who, severed.reason === "last-approver" ? 409 : 404, words, "/people");
+        }
+        return redirect(response, `/people?said=${encodeURIComponent(`${name} can no longer sign in — their sessions, invites, and signed modes ended with them; history stays`)}`);
+    }
+    async function signInPage(ctx) {
+        const { url, response } = ctx;
+        if (options.setupCode !== undefined && store.listApprovers().length === 0) {
+            return page(response, 200, signupPage(null, runtime.setupAttemptsLeft));
+        }
+        return page(response, 200, loginPage(null, loginReturn(url.searchParams.get("return")), ssoOffer()));
+    }
+    // The one-time link `up` opens (onboarding): it signs the browser on this computer in and lands on Chat. Spent on
+    // the first visit whatever happens; the ledger notes the sign-in, never the link.
+    async function signInLink(ctx) {
+        const { url, request, response } = ctx;
+        const code = url.pathname.slice(SIGN_IN_LINK_PATH.length);
+        const held = /^[A-Za-z0-9_-]{43}$/.test(code) ? signInLinks.get(linkKey(code)) : undefined;
+        if (held !== undefined)
+            signInLinks.delete(linkKey(code));
+        response.setHeader("Referrer-Policy", "no-referrer");
+        if (!fromThisComputer(request)) {
+            recordSignIn(held?.account ?? "unknown account", "sign-in refused", "one-time link", "opened from another device");
+            return page(response, 403, loginPage("That sign-in link works only in a browser on the computer running Toolroll. Sign in with your password.", "/chat", ssoOffer()));
+        }
+        if (held === undefined || held.expires < Date.now()) {
+            return page(response, 410, loginPage("That sign-in link has been used or has expired. Sign in with your password, or run toolroll up again.", "/chat", ssoOffer()));
+        }
+        const account = store.accountOf(held.account);
+        if (account === null || account.role !== "approver" || account.revokedAt !== null)
+            return page(response, 403, loginPage("That account can't sign in here any more.", "/chat", ssoOffer()));
+        if (!passwordAllowed(held.account))
+            return page(response, 403, loginPage(`Sign in with ${ssoSettings()?.label ?? "your identity provider"}.`, "/chat", ssoOffer()));
+        const id = randomBytes(32).toString("hex");
+        sessions.set(id, { ...arrival(request), name: held.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
+            project: defaultProject, projectRevision: 1 });
+        recordSignIn(held.account, "signed in", "one-time link");
+        response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
+        return redirect(response, "/chat");
+    }
+    // v100: sign-in with the identity provider. ?reauth=1 asks it to check the person again (a step-up);
+    // ?link=1 links the signed-in account to it. The browser that starts it holds the visit's state.
+    async function ssoStart(ctx) {
+        const { url, who, request, response } = ctx;
+        const settings = ssoSettings();
+        const intent = url.searchParams.get("link") === "1" ? "link" : url.searchParams.get("reauth") === "1" ? "reauth" : "sign-in";
+        const returnTo = loginReturn(url.searchParams.get("return"));
+        if (settings === null)
+            return page(response, 404, loginPage("Sign-in with an identity provider isn't on.", returnTo));
+        if (intent !== "sign-in" && who?.via !== "cookie")
+            return redirect(response, loginHref(returnTo));
+        const origin = consoleOrigin(request.headers.host);
+        if (origin === null)
+            return page(response, 400, loginPage("Sign in from this computer (localhost) or from your https address.", returnTo, ssoOffer()));
+        const found = await providerFor(settings.issuer);
+        if (!found.ok)
+            return page(response, 502, loginPage(`${settings.label} isn't answering: ${found.said}`, returnTo, ssoOffer()));
+        const visit = newOidcVisit(), redirectUri = `${origin}${SSO_CALLBACK}`;
+        for (const [key, one] of ssoVisits)
+            if (one.expires < Date.now())
+                ssoVisits.delete(key);
+        // Bounded: anyone may start a sign-in, so the oldest waiting ones give way.
+        while (ssoVisits.size >= 1000)
+            ssoVisits.delete(ssoVisits.keys().next().value);
+        ssoVisits.set(visit.state, { visit, provider: found.provider, redirect: redirectUri, intent, returnTo, expires: Date.now() + 15 * 60_000 });
+        response.writeHead(302, { location: oidcAuthorizeUrl(found.provider, settings, visit, redirectUri, intent === "reauth"), "cache-control": "no-store", "referrer-policy": "no-referrer",
+            "set-cookie": `${SIGN_IN_COOKIE}=${visit.state}; Path=${SSO_CALLBACK}; Max-Age=900; HttpOnly; SameSite=Lax${origin.startsWith("https:") ? "; Secure" : ""}` });
+        response.end();
+        return;
+    }
+    async function ssoReturn(ctx) {
+        return ssoCallback(ctx.request, ctx.response, ctx.url);
+    }
+    async function ssoFinish(ctx) {
+        const { url, who, request, response } = ctx;
+        const key = url.searchParams.get("h") ?? "";
+        if (!startedHere(request, key))
+            return page(response, 400, loginPage("That sign-in was started in another browser. Sign in again from this one.", "/", ssoOffer()));
+        const handoff = ssoHandoffs.get(key);
+        ssoHandoffs.delete(key);
+        response.setHeader("Set-Cookie", signInSpent("/login/sso/finish"));
+        const settings = ssoSettings();
+        if (handoff === undefined || handoff.expires < Date.now() || settings === null)
+            return page(response, 400, loginPage("That sign-in expired. Try again.", "/", ssoOffer()));
+        const { claims } = handoff;
+        const identity = { issuer: handoff.issuer, subject: claims.sub, email: claims.email, label: settings.label };
+        if (handoff.intent === "link" || handoff.intent === "reauth") {
+            if (who?.via !== "cookie")
+                return redirect(response, loginHref(handoff.returnTo));
+            if (handoff.intent === "link") {
+                const linked = store.linkSsoIdentity(who.name, identity, clock());
+                if (!linked.ok)
+                    return redirect(response, `/settings/sign-in?problem=${encodeURIComponent(`That ${settings.label} account signs in as someone else here.`)}`);
                 who.session.sso = { at: Date.now() };
                 sessions.persist(who.session);
-                recordSignIn(who.name, "confirmed", settings.label);
-                return redirect(response, handoff.returnTo);
-            }
-            const rule = accessFromGroups(claims.groups, settings.rules);
-            const signedIn = store.signInWithSso(identity, rule === null ? null : { role: rule.role === "operator" ? "approver" : "viewer", projects: rule.projects === "all" ? null : rule.projects }, () => accountNameFor(claims, name => store.accountOf(name) !== null), clock());
-            if (!signedIn.ok) {
-                recordSignIn(store.ssoAccount(identity.issuer, identity.subject) ?? "unknown account", "sign-in refused", signedIn.reason === "no-group" ? "no matching group" : signedIn.reason);
-                return page(response, 403, loginPage(signedIn.reason === "no-group" ? `Your ${settings.label} account isn't in a group that may use Toolroll. Ask whoever runs it.`
-                    : signedIn.reason === "revoked" ? "This account was removed. Ask whoever runs Toolroll." : "That change would leave no one who can run this installation.", "/", ssoOffer()));
-            }
-            const account = store.accountOf(signedIn.account);
-            const id = randomBytes(32).toString("hex");
-            sessions.set(id, { ...arrival(request), name: signedIn.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
-                project: defaultProject, projectRevision: 1, sso: { at: Date.now() } });
-            recordSignIn(signedIn.account, "signed in", settings.label);
-            response.setHeader("Set-Cookie", [signInSpent("/login/sso/finish"), `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
+                return redirect(response, `/settings/sign-in?said=${encodeURIComponent(`This account signs in with ${settings.label} now.`)}`);
+            }
+            // A step-up: the provider checked the same person again.
+            if (store.ssoAccount(identity.issuer, identity.subject) !== who.name)
+                return page(response, 403, loginPage(`That ${settings.label} account isn't the one signed in here.`, handoff.returnTo, ssoOffer()));
+            who.session.sso = { at: Date.now() };
+            sessions.persist(who.session);
+            recordSignIn(who.name, "confirmed", settings.label);
             return redirect(response, handoff.returnTo);
         }
-        if (url.pathname === "/signup" && method === "POST") {
-            // Only while the table is empty, only with the printed code, only
-            // five tries: the bootstrap door underneath is atomic, so two first
-            // visitors serialize to one owner.
-            if (options.setupCode === undefined || store.listApprovers().length > 0) {
-                return page(response, 409, loginPage("an account already exists — sign in"));
-            }
-            if (runtime.setupAttemptsLeft <= 0) {
-                return page(response, 403, signupPage("too many wrong codes — restart the server to get a fresh code", 0));
-            }
-            const body = readForm(await form(request), CONSOLE_FORMS.signup);
-            const code = (body.get("code") ?? "").trim();
-            const name = (body.get("name") ?? "").trim();
-            const password = body.get("password") ?? "";
-            const given = Buffer.from(code.padEnd(64, " "), "utf8");
-            const wanted = Buffer.from(options.setupCode.padEnd(64, " "), "utf8");
-            if (code === "" || !timingSafeEqual(given, wanted)) {
-                runtime.setupAttemptsLeft -= 1;
-                return page(response, 403, signupPage("that is not the setup code the server printed", runtime.setupAttemptsLeft));
-            }
-            if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name)) {
-                return page(response, 400, signupPage("a username is letters, digits, dots, dashes — up to 64", runtime.setupAttemptsLeft));
-            }
-            if (password.length < 8) {
-                return page(response, 400, signupPage("a password is at least 8 characters", runtime.setupAttemptsLeft));
-            }
-            const made = store.bootstrapApproverIfNone(name, hashPassword(password), clock());
-            if (!made.ok)
-                return page(response, 409, loginPage("an account already exists — sign in"));
-            const authenticated = authenticateAccount(store, name, password);
-            if (authenticated === null || !authenticated.ok)
-                return page(response, 500, loginPage("the account was created but could not sign in — try again"));
-            const id = randomBytes(32).toString("hex");
-            sessions.set(id, {
-                ...arrival(request),
-                name,
-                csrf: randomBytes(32).toString("hex"),
-                role: authenticated.role,
-                generation: authenticated.generation,
-                createdAt: Date.now(),
-                sawBoardAt: null,
-                lastSeen: Date.now(),
-                project: defaultProject,
-                projectRevision: 1,
-            });
-            response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
-            return redirect(response, "/");
-        }
-        if (url.pathname === "/login" && method === "POST") {
-            const body = readForm(await form(request), CONSOLE_FORMS.login);
-            const name = body.get("name");
-            const token = body.get("token");
-            // The destination a deep link asked for rides the form as a same-site
-            // path, re-checked here on both roads: a failed sign-in keeps it, a
-            // successful one lands on it. Nothing about the sign-in itself changes.
-            const returnTo = loginReturn(body.get("return"));
-            const source = joinSourceOf(request), at = Date.now();
-            const wait = signInBudget.waitFor(source, at);
-            if (wait > 0) {
-                recordSignIn(signInActor(name), "sign-in refused", "too many tries", "from one address");
-                response.setHeader("Retry-After", String(Math.ceil(wait / 1000)));
-                return page(response, 429, loginPage(`Too many sign-in attempts. Try again in ${minutesWords(wait)}.`, returnTo));
-            }
-            const authenticated = name !== null && token !== null ? authenticateAccount(store, name, token) : null;
-            if (authenticated === null || !authenticated.ok) {
-                if (authenticated?.reason === "locked") {
-                    const locked = authenticated.retryAfterMs;
-                    recordSignIn(signInActor(name), "sign-in refused", "locked");
-                    response.setHeader("Retry-After", String(Math.ceil(locked / 1000)));
-                    return page(response, 429, loginPage(`Too many wrong passwords. Try again in ${minutesWords(locked)}.`, returnTo));
-                }
-                signInBudget.failed(source, at);
-                recordSignIn(signInActor(name), "sign-in refused", "wrong password");
-                return page(response, 403, loginPage("wrong username or password", returnTo, ssoOffer()));
-            }
-            if (!passwordAllowed(name)) {
-                recordSignIn(name, "sign-in refused", "provider only");
-                return page(response, 403, loginPage(`Sign in with ${ssoSettings()?.label ?? "your identity provider"}.`, returnTo, ssoOffer()));
-            }
-            recordSignIn(name, "signed in", "browser");
-            const id = randomBytes(32).toString("hex");
-            sessions.set(id, {
-                ...arrival(request),
-                name: name,
-                csrf: randomBytes(32).toString("hex"),
-                role: authenticated.role,
-                generation: authenticated.generation,
-                createdAt: Date.now(),
-                sawBoardAt: null,
-                lastSeen: Date.now(),
-                project: defaultProject,
-                projectRevision: 1,
-            });
-            response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
-            return redirect(response, returnTo);
-        }
-        if (url.pathname === "/logout" && method === "POST") {
-            const cookies = request.headers.cookie ?? "";
-            const match = new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([0-9a-f]{64})`).exec(cookies);
-            if (match !== null) {
-                const leaving = sessions.get(match[1]);
-                if (leaving !== undefined)
-                    recordSignIn(leaving.name, "signed out", "browser");
-                sessions.delete(match[1]);
-            }
-            response.setHeader("Set-Cookie", `${SESSION_COOKIE}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${cookieSecure}`);
-            return redirect(response, "/login");
-        }
-        // THE JOIN ROAD (v29, D6/E3): a single-use invite is the only door
-        // that creates an account from the outside. Cookie-free, script-free,
-        // and every dead token shape — unknown, expired, revoked, consumed,
-        // attempts spent — answers with ONE indistinguishable page. GET spends
-        // nothing; a POST spends one metered attempt BEFORE the KDF runs.
-        const joinToken = /^\/join\/([A-Za-z0-9_-]{16,64})$/.exec(url.pathname)?.[1];
-        if (joinToken !== undefined && method === "GET") {
-            return page(response, 200, store.inviteIsLive(joinToken, clock()) ? joinFormPage(joinToken, null, "") : joinDeadPage());
-        }
-        if (joinToken !== undefined && method === "POST") {
-            // EXACT media type (Codex people round 2, finding 5): parameters may
-            // follow a semicolon; a merely prefix-shaped type is not a form.
-            const media = String(request.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase();
-            if (media !== "application/x-www-form-urlencoded") {
-                return respond(response, 415, "text/plain; charset=utf-8", "forms only");
-            }
-            let body;
-            try {
-                body = readForm(await form(request), CONSOLE_FORMS.join);
-            }
-            catch {
-                return respond(response, 413, "text/plain; charset=utf-8", "body too large");
-            }
-            for (const field of ["name", "password"]) {
-                if (body.getAll(field).length > 1) {
-                    return respond(response, 400, "text/plain; charset=utf-8", `duplicated ${field} field`);
-                }
-            }
-            if (!takeJoinAttempt(joinSourceOf(request))) {
-                return respond(response, 429, "text/plain; charset=utf-8", "too many sign-up attempts right now — try again in a few minutes");
-            }
-            const admitted = store.admitInviteAttempt(joinToken, clock());
-            if (admitted === null)
-                return page(response, 200, joinDeadPage());
-            const name = (body.get("name") ?? "").trim();
-            const password = body.get("password") ?? "";
-            // Possession of a LIVE token earns real words (D6's disclosure
-            // ruling) — the attempt is already spent either way (E3).
-            if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,39}$/.test(name)) {
-                return page(response, 400, joinFormPage(joinToken, "names are 1\u201340 characters \u2014 letters, digits, dots, dashes, underscores", name));
-            }
-            if (password.length < 8) {
-                return page(response, 400, joinFormPage(joinToken, "the password needs at least 8 characters", name));
+        const rule = accessFromGroups(claims.groups, settings.rules);
+        const signedIn = store.signInWithSso(identity, rule === null ? null : { role: rule.role === "operator" ? "approver" : "viewer", projects: rule.projects === "all" ? null : rule.projects }, () => accountNameFor(claims, name => store.accountOf(name) !== null), clock());
+        if (!signedIn.ok) {
+            recordSignIn(store.ssoAccount(identity.issuer, identity.subject) ?? "unknown account", "sign-in refused", signedIn.reason === "no-group" ? "no matching group" : signedIn.reason);
+            return page(response, 403, loginPage(signedIn.reason === "no-group" ? `Your ${settings.label} account isn't in a group that may use Toolroll. Ask whoever runs it.`
+                : signedIn.reason === "revoked" ? "This account was removed. Ask whoever runs Toolroll." : "That change would leave no one who can run this installation.", "/", ssoOffer()));
+        }
+        const account = store.accountOf(signedIn.account);
+        const id = randomBytes(32).toString("hex");
+        sessions.set(id, { ...arrival(request), name: signedIn.account, csrf: randomBytes(32).toString("hex"), role: account.role, generation: account.generation, createdAt: Date.now(), sawBoardAt: null, lastSeen: Date.now(),
+            project: defaultProject, projectRevision: 1, sso: { at: Date.now() } });
+        recordSignIn(signedIn.account, "signed in", settings.label);
+        response.setHeader("Set-Cookie", [signInSpent("/login/sso/finish"), `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`]);
+        return redirect(response, handoff.returnTo);
+    }
+    async function signupSend(ctx) {
+        const { request, response } = ctx;
+        // Only while the table is empty, only with the printed code, only
+        // five tries: the bootstrap door underneath is atomic, so two first
+        // visitors serialize to one owner.
+        if (options.setupCode === undefined || store.listApprovers().length > 0) {
+            return page(response, 409, loginPage("an account already exists — sign in"));
+        }
+        if (runtime.setupAttemptsLeft <= 0) {
+            return page(response, 403, signupPage("too many wrong codes — restart the server to get a fresh code", 0));
+        }
+        const body = readForm(await form(request), CONSOLE_FORMS.signup);
+        const code = (body.get("code") ?? "").trim();
+        const name = (body.get("name") ?? "").trim();
+        const password = body.get("password") ?? "";
+        const given = Buffer.from(code.padEnd(64, " "), "utf8");
+        const wanted = Buffer.from(options.setupCode.padEnd(64, " "), "utf8");
+        if (code === "" || !timingSafeEqual(given, wanted)) {
+            runtime.setupAttemptsLeft -= 1;
+            return page(response, 403, signupPage("that is not the setup code the server printed", runtime.setupAttemptsLeft));
+        }
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name)) {
+            return page(response, 400, signupPage("a username is letters, digits, dots, dashes — up to 64", runtime.setupAttemptsLeft));
+        }
+        if (password.length < 8) {
+            return page(response, 400, signupPage("a password is at least 8 characters", runtime.setupAttemptsLeft));
+        }
+        const made = store.bootstrapApproverIfNone(name, hashPassword(password), clock());
+        if (!made.ok)
+            return page(response, 409, loginPage("an account already exists — sign in"));
+        const authenticated = authenticateAccount(store, name, password);
+        if (authenticated === null || !authenticated.ok)
+            return page(response, 500, loginPage("the account was created but could not sign in — try again"));
+        const id = randomBytes(32).toString("hex");
+        sessions.set(id, {
+            ...arrival(request),
+            name,
+            csrf: randomBytes(32).toString("hex"),
+            role: authenticated.role,
+            generation: authenticated.generation,
+            createdAt: Date.now(),
+            sawBoardAt: null,
+            lastSeen: Date.now(),
+            project: defaultProject,
+            projectRevision: 1,
+        });
+        response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
+        return redirect(response, "/");
+    }
+    async function loginSend(ctx) {
+        const { request, response } = ctx;
+        const body = readForm(await form(request), CONSOLE_FORMS.login);
+        const name = body.get("name");
+        const token = body.get("token");
+        // The destination a deep link asked for rides the form as a same-site
+        // path, re-checked here on both roads: a failed sign-in keeps it, a
+        // successful one lands on it. Nothing about the sign-in itself changes.
+        const returnTo = loginReturn(body.get("return"));
+        const source = joinSourceOf(request), at = Date.now();
+        const wait = signInBudget.waitFor(source, at);
+        if (wait > 0) {
+            recordSignIn(signInActor(name), "sign-in refused", "too many tries", "from one address");
+            response.setHeader("Retry-After", String(Math.ceil(wait / 1000)));
+            return page(response, 429, loginPage(`Too many sign-in attempts. Try again in ${minutesWords(wait)}.`, returnTo));
+        }
+        const authenticated = name !== null && token !== null ? authenticateAccount(store, name, token) : null;
+        if (authenticated === null || !authenticated.ok) {
+            if (authenticated?.reason === "locked") {
+                const locked = authenticated.retryAfterMs;
+                recordSignIn(signInActor(name), "sign-in refused", "locked");
+                response.setHeader("Retry-After", String(Math.ceil(locked / 1000)));
+                return page(response, 429, loginPage(`Too many wrong passwords. Try again in ${minutesWords(locked)}.`, returnTo));
+            }
+            signInBudget.failed(source, at);
+            recordSignIn(signInActor(name), "sign-in refused", "wrong password");
+            return page(response, 403, loginPage("wrong username or password", returnTo, ssoOffer()));
+        }
+        if (!passwordAllowed(name)) {
+            recordSignIn(name, "sign-in refused", "provider only");
+            return page(response, 403, loginPage(`Sign in with ${ssoSettings()?.label ?? "your identity provider"}.`, returnTo, ssoOffer()));
+        }
+        recordSignIn(name, "signed in", "browser");
+        const id = randomBytes(32).toString("hex");
+        sessions.set(id, {
+            ...arrival(request),
+            name: name,
+            csrf: randomBytes(32).toString("hex"),
+            role: authenticated.role,
+            generation: authenticated.generation,
+            createdAt: Date.now(),
+            sawBoardAt: null,
+            lastSeen: Date.now(),
+            project: defaultProject,
+            projectRevision: 1,
+        });
+        response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
+        return redirect(response, returnTo);
+    }
+    async function logout(ctx) {
+        const { request, response } = ctx;
+        const cookies = request.headers.cookie ?? "";
+        const match = new RegExp(`(?:^|;\\s*)${SESSION_COOKIE}=([0-9a-f]{64})`).exec(cookies);
+        if (match !== null) {
+            const leaving = sessions.get(match[1]);
+            if (leaving !== undefined)
+                recordSignIn(leaving.name, "signed out", "browser");
+            sessions.delete(match[1]);
+        }
+        response.setHeader("Set-Cookie", `${SESSION_COOKIE}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${cookieSecure}`);
+        return redirect(response, "/login");
+    }
+    // THE JOIN ROAD (v29, D6/E3): a single-use invite is the only door
+    // that creates an account from the outside. Cookie-free, script-free,
+    // and every dead token shape — unknown, expired, revoked, consumed,
+    // attempts spent — answers with ONE indistinguishable page. GET spends
+    // nothing; a POST spends one metered attempt BEFORE the KDF runs.
+    async function joinPage(ctx) {
+        const { url, response } = ctx;
+        const joinToken = joinCodeOf(url);
+        return page(response, 200, store.inviteIsLive(joinToken, clock()) ? joinFormPage(joinToken, null, "") : joinDeadPage());
+    }
+    async function joinSend(ctx) {
+        const { url, request, response } = ctx;
+        const joinToken = joinCodeOf(url);
+        // EXACT media type (Codex people round 2, finding 5): parameters may
+        // follow a semicolon; a merely prefix-shaped type is not a form.
+        const media = String(request.headers["content-type"] ?? "").split(";")[0]?.trim().toLowerCase();
+        if (media !== "application/x-www-form-urlencoded") {
+            return respond(response, 415, "text/plain; charset=utf-8", "forms only");
+        }
+        let body;
+        try {
+            body = readForm(await form(request), CONSOLE_FORMS.join);
+        }
+        catch {
+            return respond(response, 413, "text/plain; charset=utf-8", "body too large");
+        }
+        for (const field of ["name", "password"]) {
+            if (body.getAll(field).length > 1) {
+                return respond(response, 400, "text/plain; charset=utf-8", `duplicated ${field} field`);
             }
-            const made = store.consumeInviteAndCreateAccount({ tokenValue: joinToken, name, credentialHash: hashPassword(password) }, clock());
-            if (!made.ok) {
-                if (made.reason === "name-taken") {
-                    return page(response, 400, joinFormPage(joinToken, "that name is taken \u2014 pick another", name));
-                }
-                return page(response, 200, joinDeadPage());
+        }
+        if (!takeJoinAttempt(joinSourceOf(request))) {
+            return respond(response, 429, "text/plain; charset=utf-8", "too many sign-up attempts right now — try again in a few minutes");
+        }
+        const admitted = store.admitInviteAttempt(joinToken, clock());
+        if (admitted === null)
+            return page(response, 200, joinDeadPage());
+        const name = (body.get("name") ?? "").trim();
+        const password = body.get("password") ?? "";
+        // Possession of a LIVE token earns real words (D6's disclosure
+        // ruling) — the attempt is already spent either way (E3).
+        if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,39}$/.test(name)) {
+            return page(response, 400, joinFormPage(joinToken, "names are 1\u201340 characters \u2014 letters, digits, dots, dashes, underscores", name));
+        }
+        if (password.length < 8) {
+            return page(response, 400, joinFormPage(joinToken, "the password needs at least 8 characters", name));
+        }
+        const made = store.consumeInviteAndCreateAccount({ tokenValue: joinToken, name, credentialHash: hashPassword(password) }, clock());
+        if (!made.ok) {
+            if (made.reason === "name-taken") {
+                return page(response, 400, joinFormPage(joinToken, "that name is taken \u2014 pick another", name));
             }
-            // The cookie mints only AFTER the commit — same shape as login.
-            const id = randomBytes(32).toString("hex");
-            sessions.set(id, {
-                ...arrival(request),
-                name,
-                csrf: randomBytes(32).toString("hex"),
-                role: made.role,
-                generation: 1,
-                createdAt: Date.now(),
-                sawBoardAt: null,
-                lastSeen: Date.now(),
-                project: defaultProject,
-                projectRevision: 1,
-            });
-            response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
-            return redirect(response, "/");
-        }
-        return refuse(response, who, 404, "There's no page at this address.", "/chat");
+            return page(response, 200, joinDeadPage());
+        }
+        // The cookie mints only AFTER the commit — same shape as login.
+        const id = randomBytes(32).toString("hex");
+        sessions.set(id, {
+            ...arrival(request),
+            name,
+            csrf: randomBytes(32).toString("hex"),
+            role: made.role,
+            generation: 1,
+            createdAt: Date.now(),
+            sawBoardAt: null,
+            lastSeen: Date.now(),
+            project: defaultProject,
+            projectRevision: 1,
+        });
+        response.setHeader("Set-Cookie", `${SESSION_COOKIE}=${id}; HttpOnly; SameSite=Strict; Path=/${cookieSecure}`);
+        return redirect(response, "/");
+    }
+    /** The invite code in /join/:code (the route's pattern has already proven its shape). */
+    function joinCodeOf(url) {
+        return url.pathname.slice("/join/".length);
     }
     function takeJoinAttempt(source) {
         const at = Date.now();
@@ -649,7 +656,7 @@ export function createPeopleHandlers(runtime) {
             // The hand-off key is this browser's alone, like the visit's state: its cookie rides to /login/sso/finish.
             "set-cookie": [signInSpent(SSO_CALLBACK), `${SIGN_IN_COOKIE}=${key}; Path=/login/sso/finish; Max-Age=60; HttpOnly; SameSite=Lax${held.redirect.startsWith("https:") ? "; Secure" : ""}`],
             "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; base-uri 'none'" });
-        response.end(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="refresh" content="0;url=${escape(to)}"><title>Toolroll</title>${HANDOFF_STYLE}<p>Signing you in… <a href="${escape(to)}">Continue</a></p>`);
+        response.end(htmlString(html `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta http-equiv="refresh" content="0;url=${to}"><title>Toolroll</title>${HANDOFF_STYLE}<p>Signing you in… <a href="${to}">Continue</a></p>`));
     }
     function readAccessForm(body) {
         if (body.getAll("access").length > 1)
@@ -666,24 +673,25 @@ export function createPeopleHandlers(runtime) {
             return { ok: false, message: "Choose projects available on this instance." };
         return { ok: true, projects };
     }
-    const registrations = [
-        { id: "settings.sessions-send", domain: "people", stage: "console", method: "POST", handle: post },
-        { id: "settings.sessions", domain: "people", stage: "console", method: "GET", handle: get },
-        { id: "edge.login-page", domain: "people", stage: "edge", method: "GET", handle: edge },
-        { id: "edge.login-link", domain: "people", stage: "edge", method: "GET", handle: edge },
-        { id: "edge.sso-start", domain: "people", stage: "edge", method: "GET", handle: edge },
-        { id: "edge.sso-callback", domain: "people", stage: "edge", method: "GET", handle: edge },
-        { id: "edge.sso-finish", domain: "people", stage: "edge", method: "GET", handle: edge },
-        { id: "edge.signup", domain: "people", stage: "edge", method: "POST", handle: edge },
-        { id: "edge.login", domain: "people", stage: "edge", method: "POST", handle: edge },
-        { id: "edge.logout", domain: "people", stage: "edge", method: "POST", handle: edge },
-        { id: "edge.join", domain: "people", stage: "edge", method: "GET", handle: edge },
-        { id: "edge.join-send", domain: "people", stage: "edge", method: "POST", handle: edge },
-        { id: "people.page", domain: "people", stage: "console", method: "GET", handle: get },
-        { id: "people.projects", domain: "people", stage: "console", method: "POST", handle: post },
-        { id: "people.invite", domain: "people", stage: "console", method: "POST", handle: post },
-        { id: "people.invite-revoke", domain: "people", stage: "console", method: "POST", handle: post },
-        { id: "people.revoke", domain: "people", stage: "console", method: "POST", handle: post },
-    ];
-    return { registrations, get, post, edge, takeJoinAttempt, ssoCallback, readAccessForm };
+    const registrations = handlersOf("people", {
+        "people.page": peoplePage,
+        "settings.sessions": sessionsPage,
+        "settings.sessions-send": sessionsSend,
+        "people.projects": peopleProjects,
+        "people.invite": peopleInvite,
+        "people.invite-revoke": peopleInviteRevoke,
+        "people.revoke": peopleRevoke,
+    }, {
+        "edge.login-page": signInPage,
+        "edge.login-link": signInLink,
+        "edge.sso-start": ssoStart,
+        "edge.sso-callback": ssoReturn,
+        "edge.sso-finish": ssoFinish,
+        "edge.signup": signupSend,
+        "edge.login": loginSend,
+        "edge.logout": logout,
+        "edge.join": joinPage,
+        "edge.join-send": joinSend,
+    });
+    return { registrations, takeJoinAttempt, ssoCallback, readAccessForm };
 }