Replaces #2409. Both tries' checks went red without a named test. The pull must quote the first red line of its check if it goes red again.
Done looks like:
[ ] POST /api/v1/tokens, the token page and any MCP token tool refuse scope: "admin" to a non-admin with 403 and one plain sentence. ro and rw are unchanged.
[ ] Test: a member gets 403 for admin and 201 for rw; an admin can still mint admin.
[ ] Run bun x tsc --noEmit, test/branches.test.ts and every file that mints tokens (grep -l api/v1/tokens test/*.ts), and quote the result.
Replaces #2409. Both tries' checks went red without a named test. The pull must quote the first red line of its check if it goes red again.
Done looks like:
POST /api/v1/tokens, the token page and any MCP token tool refusescope: "admin"to a non-admin with 403 and one plain sentence.roandrware unchanged.adminand 201 forrw; an admin can still mintadmin.bun x tsc --noEmit,test/branches.test.tsand every file that mints tokens (grep -l api/v1/tokens test/*.ts), and quote the result.