@mauricode/token-derby 2.13.1 → 3.0.0

package/dist/bin.js

@@ -36,7 +36,9 @@ var CLI_VERSION_HEADER = "x-cli-version";
 var USER_ID_HEADER = "x-user-id";
 var USER_TOKEN_HEADER = "x-user-token";
 var USER_NAME_MAX_LENGTH = 40;
+var SECRET_TOKEN_BYTES = 32;
 var ORG_NAME_PATTERN = /^[A-Za-z0-9]{1,12}$/;
+var DEVICE_LABEL_MAX_LENGTH = 40;
 
 // ../shared/dist/version-match.js
 var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/;
@@ -289,6 +291,22 @@ var STAMINA_PARAM_BOUNDS = {
   tired_multiplier: { min: 0.2, max: 0.9, step: 0.05, default: STAMINA.TIRED_MULTIPLIER }
 };
 
+// ../shared/dist/devices.js
+var DEVICE_CODE_LENGTH = Math.ceil(SECRET_TOKEN_BYTES * 4 / 3);
+var UNSAFE_LABEL_CHARS = /[\p{Cc}\p{Cf}]/u;
+function validateDeviceLabel(raw) {
+  if (typeof raw !== "string")
+    return { ok: false, message: "label is required" };
+  const label = raw.trim();
+  if (label.length < 1 || label.length > DEVICE_LABEL_MAX_LENGTH) {
+    return { ok: false, message: `label must be 1\u2013${DEVICE_LABEL_MAX_LENGTH} characters` };
+  }
+  if (UNSAFE_LABEL_CHARS.test(label)) {
+    return { ok: false, message: "label may not contain control or invisible characters" };
+  }
+  return { ok: true, label };
+}
+
 // src/ui/HorseSprite.tsx
 import { Box, Text } from "ink";
 
@@ -825,8 +843,8 @@ var HEARTBEAT_RETRY_DELAYS_MS = [1e3, 2e3, 4e3, 8e3, 15e3];
 // src/version.ts
 import { createRequire } from "module";
 function readVersion() {
-  if ("2.13.1".length > 0) {
-    return "2.13.1";
+  if ("3.0.0".length > 0) {
+    return "3.0.0";
   }
   try {
     const req = createRequire(import.meta.url);
@@ -871,18 +889,37 @@ function geminiTmpDir() {
 }
 
 // src/identity/identity.ts
-async function loadIdentity() {
+async function readIdentityFile() {
+  let raw;
   try {
-    const raw = await fs.readFile(identityFile(), "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.user_id === "string" && typeof parsed.display_name === "string" && typeof parsed.secret_token === "string" && typeof parsed.created_at === "string") {
-      return parsed;
-    }
-    return null;
+    raw = await fs.readFile(identityFile(), "utf8");
   } catch (e) {
-    if (e?.code === "ENOENT") return null;
-    return null;
+    if (e?.code === "ENOENT") return { kind: "missing" };
+    return { kind: "unreadable", reason: `could not be read (${e?.code ?? "read error"})` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { kind: "unreadable", reason: "is not valid JSON" };
   }
+  if (!isPlainObject(parsed)) {
+    return { kind: "unreadable", reason: "does not contain an identity object" };
+  }
+  if (typeof parsed.user_id === "string" && typeof parsed.display_name === "string" && typeof parsed.secret_token === "string" && typeof parsed.created_at === "string") {
+    return { kind: "ok", identity: parsed };
+  }
+  if (!("secret_token" in parsed)) {
+    return { kind: "no-credential", reason: "holds no credential this version can use" };
+  }
+  return { kind: "unreadable", reason: "is missing fields this version expects" };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function loadIdentity() {
+  const state = await readIdentityFile();
+  return state.kind === "ok" ? state.identity : null;
 }
 async function saveIdentity(identity) {
   await fs.mkdir(homeDir(), { recursive: true });
@@ -923,12 +960,12 @@ function getIdentity() {
 function _resetIdentityCacheForTests() {
   identityCache = null;
 }
-async function request(method, path9, body, horseAuthToken, fetchImpl = fetch) {
+async function request(method, path9, body, horseAuthToken, fetchImpl = fetch, identityOverride) {
   const url = path9.startsWith("http") ? path9 : `${apiBase()}${path9}`;
   const headers = {};
   headers[CLI_VERSION_HEADER] = CLI_VERSION;
   headers["user-agent"] = `token-derby/${CLI_VERSION}`;
-  const identity = await getIdentity();
+  const identity = identityOverride ?? await getIdentity();
   if (identity) {
     headers[USER_ID_HEADER] = identity.user_id;
     headers[USER_TOKEN_HEADER] = identity.secret_token;
@@ -994,6 +1031,9 @@ function listOrganisations() {
 function initJockey(body) {
   return request("POST", "/jockey/init", body, void 0);
 }
+function getJockey() {
+  return request("GET", "/jockey/me", void 0, void 0);
+}
 function updateJockey(body) {
   return request("PUT", "/jockey/me", body, void 0);
 }
@@ -1034,6 +1074,28 @@ function probeClaim(code) {
 function redeemClaim(code, body) {
   return request("POST", `/claims/${encodeURIComponent(code)}/redeem`, body, void 0);
 }
+function cliAuthStart(body) {
+  return request("POST", "/auth/cli/start", body, void 0);
+}
+function cliAuthPoll(body) {
+  return request("POST", "/auth/cli/poll", body, void 0);
+}
+function revokeDevice(deviceId, auth) {
+  return request(
+    "DELETE",
+    `/devices/${encodeURIComponent(deviceId)}`,
+    void 0,
+    void 0,
+    void 0,
+    auth
+  );
+}
+function registerDevice(body) {
+  return request("POST", "/devices", body, void 0);
+}
+function logoutDevice() {
+  return request("DELETE", "/devices/me", void 0, void 0);
+}
 
 // src/commands/stable-create.ts
 async function stableCreateCommand() {
@@ -2461,7 +2523,7 @@ async function joinCommand(joinCode, argv = []) {
   }
   const identity = await loadIdentity();
   if (!identity) {
-    console.error("Run `token-derby init` to set up your identity.");
+    console.error("Run `token-derby login` to set up your identity.");
     return 1;
   }
   let race;
@@ -2634,72 +2696,346 @@ async function endCommand(adminCode) {
 // src/commands/init.ts
 import * as readline4 from "readline/promises";
 import { stdin as stdin4, stdout as stdout4 } from "process";
-async function initCommand(reset = false) {
-  if (reset) {
-    await deleteIdentity();
-    _resetIdentityCacheForTests();
-    console.log("Removed local identity. Creating a new one\u2026");
-  }
-  const existing = await loadIdentity();
+async function defaultPromptText(question) {
   const rl = readline4.createInterface({ input: stdin4, output: stdout4 });
   try {
-    if (existing) {
-      console.log(`Current jockey name: ${existing.display_name}`);
-      const raw2 = (await rl.question("New jockey name (use your real name please) [keep]: ")).trim();
-      if (!raw2) {
-        console.log("Kept existing name.");
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+async function initCommand(reset = false, deps = {}) {
+  const loadIdentity2 = deps.loadIdentity ?? loadIdentity;
+  const saveIdentity2 = deps.saveIdentity ?? saveIdentity;
+  const deleteIdentity2 = deps.deleteIdentity ?? deleteIdentity;
+  const readIdentityFile2 = deps.readIdentityFile ?? readIdentityFile;
+  const initJockey2 = deps.initJockey ?? initJockey;
+  const updateJockey2 = deps.updateJockey ?? updateJockey;
+  const apiGetJockey = deps.apiGetJockey ?? getJockey;
+  const promptText = deps.promptText ?? defaultPromptText;
+  const isTTY = deps.isTTY ?? Boolean(process.stdin.isTTY);
+  console.log("");
+  console.log(
+    "Heads up: `token-derby login` is becoming the only way to manage accounts on this machine. `init` still works today, but plan to move over."
+  );
+  console.log("");
+  if (reset) {
+    const current = await readIdentityFile2();
+    if (current.kind !== "missing") {
+      if (current.kind === "ok") {
+        console.log(`About to abandon jockey: ${current.identity.display_name}`);
+      } else if (current.kind === "unreadable") {
+        console.log(`About to delete identity.json, which ${current.reason}.`);
+        console.log("The credential inside cannot be read, so there is no way to tell which jockey");
+        console.log("this is, or whether anything else can still recover it.");
+      } else {
+        console.log(`About to delete identity.json, which ${current.reason}.`);
+      }
+      console.log("This deletes the local identity only \u2014 the account itself stays on the server.");
+      if (current.kind === "ok") {
+        try {
+          const me = await apiGetJockey();
+          if (me.device_label) {
+            console.log(`  This machine's credential, "${me.device_label}", will stay live on the`);
+            console.log("  abandoned account and can only be revoked from the Account view in the org manager.");
+          }
+          if (me.email) {
+            console.log("  This account has a Google account linked \u2014 `token-derby login` would recover");
+            console.log("  this same jockey instead of abandoning it.");
+          }
+        } catch {
+        }
+      }
+      if (!isTTY) {
+        console.error("");
+        console.error("Refusing to reset without a terminal to confirm \u2014 this is irreversible.");
+        console.error(
+          "Run `token-derby init --reset` interactively, or use `token-derby login` to recover this jockey instead."
+        );
+        return 1;
+      }
+      const answer = (await promptText('Type "yes" to abandon this jockey [no]: ')).trim().toLowerCase();
+      if (answer !== "yes") {
+        console.log("Reset cancelled. Nothing was deleted.");
         return 0;
       }
-      const v2 = validateDisplayName(raw2);
-      if (!v2.ok) {
-        console.error(v2.error);
+    }
+    await deleteIdentity2();
+    _resetIdentityCacheForTests();
+    console.log("Removed local identity. Creating a new one\u2026");
+  }
+  if (!reset) {
+    const state = await readIdentityFile2();
+    if (state.kind === "unreadable") {
+      console.error(`Your local identity file ${state.reason}.`);
+      console.error("It may hold a credential that cannot be recovered, so this will not overwrite it.");
+      console.error("Run `token-derby login` to sign in fresh, or `token-derby init --reset` to discard it.");
+      return 1;
+    }
+    if (state.kind === "no-credential") {
+      console.log(`Your local identity file ${state.reason}, so this will replace it.`);
+    }
+  }
+  const existing = await loadIdentity2();
+  if (existing) {
+    console.log(`Current jockey name: ${existing.display_name}`);
+    const raw2 = (await promptText("New jockey name (use your real name please) [keep]: ")).trim();
+    if (!raw2) {
+      console.log("Kept existing name.");
+      return 0;
+    }
+    const v2 = validateDisplayName(raw2);
+    if (!v2.ok) {
+      console.error(v2.error);
+      return 1;
+    }
+    try {
+      const resp = await updateJockey2({ display_name: v2.name });
+      const updated = { ...existing, display_name: resp.display_name };
+      await saveIdentity2(updated);
+      console.log(`Updated jockey name to: ${updated.display_name}`);
+      return 0;
+    } catch (e) {
+      if (e instanceof ApiError) {
+        if (e.code === "UNAUTHENTICATED") {
+          console.error(
+            "Server does not recognise this identity. Your account may have been wiped. Run `token-derby init --reset` to start fresh."
+          );
+        } else {
+          console.error(`Error: ${e.code} ${e.message}`);
+        }
         return 1;
       }
-      try {
-        const resp = await updateJockey({ display_name: v2.name });
-        const updated = { ...existing, display_name: resp.display_name };
-        await saveIdentity(updated);
-        console.log(`Updated jockey name to: ${updated.display_name}`);
+      throw e;
+    }
+  }
+  const raw = (await promptText("Jockey Name (use your real name please): ")).trim();
+  const v = validateDisplayName(raw);
+  if (!v.ok) {
+    console.error(v.error);
+    return 1;
+  }
+  try {
+    const resp = await initJockey2({ display_name: v.name });
+    const identity = {
+      user_id: resp.user_id,
+      display_name: resp.display_name,
+      secret_token: resp.secret_token,
+      created_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await saveIdentity2(identity);
+    _resetIdentityCacheForTests();
+    console.log("");
+    console.log(`Welcome, ${identity.display_name}!`);
+    console.log("Your identity has been created on the server.");
+    console.log("You can now create a stable and join races.");
+    console.log("");
+    console.log("  \u26A0  Your secret token is stored locally in identity.json.");
+    console.log("     If you lose it, you cannot recover this account \u2014 you would");
+    console.log("     need to run `token-derby init --reset` and rebuild your stable.");
+    return 0;
+  } catch (e) {
+    if (e instanceof ApiError) {
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+}
+
+// src/commands/login.ts
+import { spawn as spawn2 } from "child_process";
+import * as os3 from "os";
+
+// src/commands/web.ts
+import { spawn } from "child_process";
+function webOrigin() {
+  return apiBase().replace(/\/api\/?$/, "");
+}
+function opener() {
+  if (process.platform === "darwin") return "open";
+  if (process.platform === "win32") return "start";
+  if (process.platform === "linux") return "xdg-open";
+  return null;
+}
+async function webCommand(deps = {}) {
+  const spawnImpl = deps.spawnImpl ?? spawn;
+  let code;
+  try {
+    ({ code } = await createWebSession());
+  } catch (e) {
+    if (e instanceof ApiError) {
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+  const url = `${webOrigin()}/org-manager#code=${code}`;
+  console.log("");
+  console.log("  Opening the Token Derby org manager in your browser...");
+  console.log(`  ${url}`);
+  console.log("");
+  console.log("  If it doesn't open, copy the link above. It expires in 60 seconds.");
+  const cmd = opener();
+  if (cmd) {
+    try {
+      const child = spawnImpl(cmd, [url], { stdio: "ignore", detached: true });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
+    }
+  }
+  return 0;
+}
+
+// src/ui/prompt.ts
+async function promptYesNo(question) {
+  resetStdinAfterInk();
+  const readline6 = await import("readline/promises");
+  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
+  const a = (await rl.question(question)).trim().toLowerCase();
+  rl.close();
+  return a === "" || a === "y" || a === "yes";
+}
+function resetStdinAfterInk() {
+  if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
+    process.stdin.setRawMode(false);
+  }
+  while (process.stdin.read() !== null) {
+  }
+  process.stdin.pause();
+  process.stdin.ref();
+}
+
+// src/commands/login.ts
+function parseDeviceNameFlag(argv) {
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--device-name") return argv[i + 1] ?? null;
+    if (a.startsWith("--device-name=")) return a.slice("--device-name=".length);
+  }
+  return null;
+}
+async function defaultPromptText2(question) {
+  const readline6 = await import("readline/promises");
+  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function resolveDeviceName(flagName, isTTY, hostname3, promptText) {
+  if (flagName) return flagName;
+  if (!isTTY) return hostname3;
+  const answer = (await promptText(`Device name [${hostname3}]: `)).trim();
+  return answer || hostname3;
+}
+async function loginCommand(argv = [], deps = {}) {
+  const apiStart = deps.apiStart ?? cliAuthStart;
+  const apiPoll = deps.apiPoll ?? cliAuthPoll;
+  const apiRevokeDevice = deps.apiRevokeDevice ?? revokeDevice;
+  const apiCreateWebSession = deps.apiCreateWebSession ?? createWebSession;
+  const saveIdentity2 = deps.saveIdentity ?? saveIdentity;
+  const loadIdentity2 = deps.loadIdentity ?? loadIdentity;
+  const promptText = deps.promptText ?? defaultPromptText2;
+  const promptYesNo2 = deps.promptYesNo ?? promptYesNo;
+  const sleepImpl = deps.sleepImpl ?? defaultSleep;
+  const isTTY = deps.isTTY ?? Boolean(process.stdin.isTTY);
+  const spawnImpl = deps.spawnImpl ?? spawn2;
+  const hostname3 = deps.hostname ?? (() => os3.hostname());
+  const existing = await loadIdentity2();
+  if (existing) {
+    console.log("");
+    console.log(`  This machine is already signed in as ${existing.display_name}.`);
+    console.log("  Signing in again adds a second credential; the current one stays active");
+    console.log("  until you revoke it under Account in the org manager (`token-derby web`).");
+    if (isTTY) {
+      if (!await promptYesNo2("  Sign in again anyway? [Y/n] ")) {
+        console.log("Login cancelled.");
         return 0;
-      } catch (e) {
-        if (e instanceof ApiError) {
-          if (e.code === "UNAUTHENTICATED") {
-            console.error(
-              "Server does not recognise this identity. Your account may have been wiped. Run `token-derby init --reset` to start fresh."
-            );
-          } else {
-            console.error(`Error: ${e.code} ${e.message}`);
-          }
+      }
+    } else {
+      console.log("  No TTY to confirm \u2014 continuing (equivalent to answering Y).");
+    }
+  }
+  let label = await resolveDeviceName(parseDeviceNameFlag(argv), isTTY, hostname3(), promptText);
+  let start;
+  for (; ; ) {
+    try {
+      start = await apiStart({ label });
+      break;
+    } catch (e) {
+      if (e instanceof ApiError && e.code === "BAD_REQUEST") {
+        console.error(`Error: ${e.message}`);
+        if (!isTTY) return 1;
+        const retry = (await promptText("Enter a different device name: ")).trim();
+        if (!retry) {
+          console.error("Device name cannot be empty.");
           return 1;
         }
+        label = retry;
+        continue;
+      }
+      if (e instanceof ApiError) {
+        console.error(`Error: ${e.code} ${e.message}`);
+        return 1;
+      }
+      throw e;
+    }
+  }
+  let verificationUrl = start.verification_uri;
+  let hasGrant = false;
+  if (existing) {
+    try {
+      const grant = await apiCreateWebSession();
+      verificationUrl = `${start.verification_uri}#code=${grant.code}`;
+      hasGrant = true;
+    } catch (e) {
+      if (e instanceof ApiError && e.code === "UNAUTHENTICATED") {
+        console.log("");
+        console.log("  The credential stored on this machine is no longer valid (it may have been");
+        console.log("  revoked), so this will sign you in fresh in the browser.");
+      } else if (e instanceof ApiError) {
+        console.error(`Error: ${e.code} ${e.message}`);
+        return 1;
+      } else {
         throw e;
       }
     }
-    const raw = (await rl.question("Jockey Name (use your real name please): ")).trim();
-    const v = validateDisplayName(raw);
-    if (!v.ok) {
-      console.error(v.error);
-      return 1;
+  }
+  console.log("");
+  console.log("  To finish signing in, visit:");
+  console.log(`    ${verificationUrl}`);
+  if (hasGrant) {
+    console.log("    That link signs the browser in for you and expires in 60 seconds \u2014 if it");
+    console.log("    does, run `token-derby login` again for a fresh one.");
+  }
+  console.log("");
+  console.log("  And enter this code:");
+  console.log(`    ${start.user_code}`);
+  console.log("");
+  console.log("  Waiting for approval...");
+  const cmd = opener();
+  if (cmd) {
+    try {
+      const child = spawnImpl(cmd, [verificationUrl], { stdio: "ignore", detached: true });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
     }
+  }
+  const deadline = Date.now() + start.expires_in * 1e3;
+  let approved = null;
+  while (!approved) {
+    let poll;
     try {
-      const resp = await initJockey({ display_name: v.name });
-      const identity = {
-        user_id: resp.user_id,
-        display_name: resp.display_name,
-        secret_token: resp.secret_token,
-        created_at: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      await saveIdentity(identity);
-      _resetIdentityCacheForTests();
-      console.log("");
-      console.log(`Welcome, ${identity.display_name}!`);
-      console.log("Your identity has been created on the server.");
-      console.log("You can now create a stable and join races.");
-      console.log("");
-      console.log("  \u26A0  Your secret token is stored locally in identity.json.");
-      console.log("     If you lose it, you cannot recover this account \u2014 you would");
-      console.log("     need to run `token-derby init --reset` and rebuild your stable.");
-      return 0;
+      poll = await apiPoll({ device_code: start.device_code });
     } catch (e) {
       if (e instanceof ApiError) {
         console.error(`Error: ${e.code} ${e.message}`);
@@ -2707,21 +3043,292 @@ async function initCommand(reset = false) {
       }
       throw e;
     }
+    if (poll.status === "approved") {
+      approved = poll;
+      break;
+    }
+    if (Date.now() >= deadline) {
+      console.error("Login timed out waiting for approval. Run `token-derby login` again.");
+      return 1;
+    }
+    await sleepImpl(start.interval * 1e3);
+  }
+  console.log("");
+  if (approved.email) console.log(`  \u2713 Signed in as ${approved.email}`);
+  console.log(
+    `    Linking to your existing jockey: ${approved.display_name} (${approved.horses} horses, ${approved.orgs} orgs)`
+  );
+  let proceed;
+  if (isTTY) {
+    proceed = await promptYesNo2("    Link this account? [Y/n] ");
+  } else {
+    console.log("    No TTY to confirm \u2014 proceeding automatically (equivalent to answering Y).");
+    proceed = true;
+  }
+  if (!proceed) {
+    try {
+      await apiRevokeDevice(approved.device_id, { user_id: approved.user_id, secret_token: approved.secret_token });
+    } catch (e) {
+      console.error("Declined, but could not revoke the device credential on the server.");
+      if (e instanceof ApiError) console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    console.log("Login cancelled.");
+    return 0;
+  }
+  const identity = {
+    user_id: approved.user_id,
+    display_name: approved.display_name,
+    secret_token: approved.secret_token,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await saveIdentity2(identity);
+  console.log("");
+  console.log(`Welcome back, ${identity.display_name}!`);
+  return 0;
+}
+
+// src/commands/logout.ts
+async function logoutCommand(deps = {}) {
+  const apiLogoutDevice = deps.apiLogoutDevice ?? logoutDevice;
+  const deleteIdentity2 = deps.deleteIdentity ?? deleteIdentity;
+  try {
+    const result = await apiLogoutDevice();
+    if (result.revoked) {
+      console.log("Revoked this device's credential on the server.");
+    } else {
+      console.log(
+        "This machine is signed in with a legacy account credential (never linked via `token-derby login`), so there is no separate device credential to revoke."
+      );
+    }
+  } catch (e) {
+    if (e instanceof ApiError && e.code === "UNAUTHENTICATED") {
+      console.error("This device credential was already invalid on the server \u2014 clearing it locally too.");
+      await deleteIdentity2();
+      console.log("Removed local identity. You are signed out.");
+      return 0;
+    }
+    if (e instanceof ApiError) {
+      console.error(`Error: ${e.code} ${e.message}`);
+      console.error("Local identity left in place \u2014 run `token-derby logout` again to retry.");
+      return 1;
+    }
+    throw e;
+  }
+  await deleteIdentity2();
+  console.log("Removed local identity. You are signed out.");
+  return 0;
+}
+
+// src/commands/link.ts
+import { spawn as spawn3 } from "child_process";
+import * as os4 from "os";
+
+// src/ui/messages.ts
+var CREDENTIAL_DEAD_MESSAGE = "This machine's credential is no longer valid on the server \u2014 it may have been revoked.\nRun `token-derby login` to sign this machine in again.";
+
+// src/commands/link.ts
+function defaultSleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function defaultPromptText3(question) {
+  const readline6 = await import("readline/promises");
+  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
   } finally {
     rl.close();
   }
 }
+var POLL_INTERVAL_MS = 2e3;
+var WAIT_TIMEOUT_MS = 5 * 60 * 1e3;
+async function linkCommand(argv = [], deps = {}) {
+  const apiGetJockey = deps.apiGetJockey ?? getJockey;
+  const apiCreateWebSession = deps.apiCreateWebSession ?? createWebSession;
+  const apiRegisterDevice = deps.apiRegisterDevice ?? registerDevice;
+  const loadIdentity2 = deps.loadIdentity ?? loadIdentity;
+  const saveIdentity2 = deps.saveIdentity ?? saveIdentity;
+  const spawnImpl = deps.spawnImpl ?? spawn3;
+  const sleepImpl = deps.sleepImpl ?? defaultSleep2;
+  const promptText = deps.promptText ?? defaultPromptText3;
+  const isTTY = deps.isTTY ?? Boolean(process.stdin.isTTY);
+  const hostname3 = deps.hostname ?? (() => os4.hostname());
+  const flagName = parseDeviceNameFlag(argv);
+  if (flagName !== null) {
+    const checked = validateDeviceLabel(flagName);
+    if (!checked.ok) {
+      console.error(`Error: invalid --device-name: ${checked.message}`);
+      return 1;
+    }
+  }
+  const syncLocalName = async (serverName) => {
+    const local = await loadIdentity2();
+    if (!local || local.display_name === serverName) return;
+    await saveIdentity2({ ...local, display_name: serverName });
+  };
+  const registerThisMachine = async (linked) => {
+    const serverName = linked.display_name;
+    if (linked.device_label) {
+      await syncLocalName(serverName);
+      console.log(`  This machine already has its own credential, "${linked.device_label}", so it`);
+      console.log("  was not registered again \u2014 a second one would leave the first live with");
+      console.log("  nothing on this machine holding it.");
+      return;
+    }
+    const local = await loadIdentity2();
+    if (!local) {
+      console.log("  This machine has no local identity file, so it was not registered as a");
+      console.log("  device. Run `token-derby login` to give it its own credential.");
+      return;
+    }
+    const named = local.display_name === serverName ? local : { ...local, display_name: serverName };
+    let label;
+    try {
+      label = await resolveDeviceName(flagName, isTTY, hostname3(), promptText);
+      for (; ; ) {
+        try {
+          const registered = await apiRegisterDevice({ label });
+          await saveIdentity2({ ...named, secret_token: registered.secret_token });
+          break;
+        } catch (e) {
+          if (!(e instanceof ApiError && e.code === "BAD_REQUEST" && isTTY)) throw e;
+          console.error(`  Error: ${e.message}`);
+          const retry = (await promptText("  Enter a different device name: ")).trim();
+          if (!retry) throw e;
+          label = retry;
+        }
+      }
+    } catch (e) {
+      try {
+        if (named !== local) await saveIdentity2(named);
+      } catch {
+      }
+      console.log("");
+      console.log("  Your account is linked \u2014 that part is done and does not need repeating.");
+      console.log("  Registering this machine as a device did not complete, so it is still");
+      console.log("  using the shared account credential. Run `token-derby login` to finish.");
+      console.error(`  Error: ${e instanceof ApiError ? `${e.code} ${e.message}` : String(e)}`);
+      return;
+    }
+    console.log(`  This machine is now registered as "${label}", with a credential of its own`);
+    console.log("  that you can revoke separately under Account in the org manager.");
+  };
+  let me;
+  try {
+    me = await apiGetJockey();
+  } catch (e) {
+    if (e instanceof ApiError) {
+      if (e.code === "UNAUTHENTICATED") {
+        console.error(CREDENTIAL_DEAD_MESSAGE);
+        return 1;
+      }
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+  if (me.email) {
+    console.log(`Already linked to ${me.email}.`);
+    await syncLocalName(me.display_name);
+    return 0;
+  }
+  let code;
+  try {
+    ({ code } = await apiCreateWebSession());
+  } catch (e) {
+    if (e instanceof ApiError) {
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+  const url = `${webOrigin()}/link#code=${code}`;
+  console.log("");
+  console.log("  Opening the Google link page in your browser...");
+  console.log(`  ${url}`);
+  console.log("");
+  console.log("  If it doesn't open, copy the link above. It expires in 60 seconds.");
+  const cmd = opener();
+  if (cmd) {
+    try {
+      const child = spawnImpl(cmd, [url], { stdio: "ignore", detached: true });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
+    }
+  }
+  console.log("");
+  console.log("  Waiting for you to finish connecting with Google...");
+  const deadline = Date.now() + WAIT_TIMEOUT_MS;
+  for (; ; ) {
+    let poll;
+    try {
+      poll = await apiGetJockey();
+    } catch (e) {
+      if (e instanceof ApiError) {
+        if (e.code === "UNAUTHENTICATED") {
+          console.error(CREDENTIAL_DEAD_MESSAGE);
+          return 1;
+        }
+        console.error(`Error: ${e.code} ${e.message}`);
+        return 1;
+      }
+      throw e;
+    }
+    if (poll.email) {
+      console.log(`\u2713 Linked to ${poll.email}.`);
+      if (poll.display_name !== me.display_name) {
+        console.log(`  Your jockey is now named ${poll.display_name} \u2014 a first link renames it to`);
+        console.log("  the first name on the Google account. `token-derby init` renames it again");
+        console.log("  if you would rather it said something else.");
+      }
+      await registerThisMachine(poll);
+      return 0;
+    }
+    if (Date.now() >= deadline) {
+      console.error("Timed out waiting for the Google link to complete. Run `token-derby link` again.");
+      return 1;
+    }
+    await sleepImpl(POLL_INTERVAL_MS);
+  }
+}
+
+// src/commands/whoami.ts
+async function whoamiCommand(deps = {}) {
+  const apiGetJockey = deps.apiGetJockey ?? getJockey;
+  let me;
+  try {
+    me = await apiGetJockey();
+  } catch (e) {
+    if (e instanceof ApiError) {
+      if (e.code === "UNAUTHENTICATED") {
+        console.error(CREDENTIAL_DEAD_MESSAGE);
+        return 1;
+      }
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+  console.log("");
+  console.log(`  ${me.display_name}`);
+  if (me.email) console.log(`  ${me.email}`);
+  if (me.device_label) console.log(`  this machine: ${me.device_label}`);
+  console.log("");
+  return 0;
+}
 
 // src/commands/update.ts
 import * as readline5 from "readline/promises";
 import { stdin as stdin5, stdout as stdout5 } from "process";
-import { spawn } from "child_process";
+import { spawn as spawn4 } from "child_process";
 var REGISTRY_URL = "https://registry.npmjs.org/@mauricode/token-derby/latest";
 var UPGRADE_CMD = "npm install -g @mauricode/token-derby@latest";
 var FETCH_TIMEOUT_MS = 5e3;
 async function updateCommand(deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const spawnImpl = deps.spawnImpl ?? spawn;
+  const spawnImpl = deps.spawnImpl ?? spawn4;
   const promptYesNo2 = deps.promptYesNo ?? defaultPromptYesNo;
   let latest;
   try {
@@ -2857,25 +3464,6 @@ function RollHorsePicker({ horses, onPick, onCancel }) {
   ] });
 }
 
-// src/ui/prompt.ts
-async function promptYesNo(question) {
-  resetStdinAfterInk();
-  const readline6 = await import("readline/promises");
-  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
-  const a = (await rl.question(question)).trim().toLowerCase();
-  rl.close();
-  return a === "" || a === "y" || a === "yes";
-}
-function resetStdinAfterInk() {
-  if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
-    process.stdin.setRawMode(false);
-  }
-  while (process.stdin.read() !== null) {
-  }
-  process.stdin.pause();
-  process.stdin.ref();
-}
-
 // src/ui/reveal.ts
 import React13 from "react";
 import { render as render5 } from "ink";
@@ -3310,48 +3898,6 @@ async function orgJoinCommand(token) {
   }
 }
 
-// src/commands/web.ts
-import { spawn as spawn2 } from "child_process";
-function webOrigin() {
-  return apiBase().replace(/\/api\/?$/, "");
-}
-function opener() {
-  if (process.platform === "darwin") return "open";
-  if (process.platform === "win32") return "start";
-  if (process.platform === "linux") return "xdg-open";
-  return null;
-}
-async function webCommand(deps = {}) {
-  const spawnImpl = deps.spawnImpl ?? spawn2;
-  let code;
-  try {
-    ({ code } = await createWebSession());
-  } catch (e) {
-    if (e instanceof ApiError) {
-      console.error(`Error: ${e.code} ${e.message}`);
-      return 1;
-    }
-    throw e;
-  }
-  const url = `${webOrigin()}/org-manager#code=${code}`;
-  console.log("");
-  console.log("  Opening the Token Derby org manager in your browser...");
-  console.log(`  ${url}`);
-  console.log("");
-  console.log("  If it doesn't open, copy the link above. It expires in 60 seconds.");
-  const cmd = opener();
-  if (cmd) {
-    try {
-      const child = spawnImpl(cmd, [url], { stdio: "ignore", detached: true });
-      child.on("error", () => {
-      });
-      child.unref();
-    } catch {
-    }
-  }
-  return 0;
-}
-
 // src/commands/env.ts
 function warnOverrides() {
   if (process.env.TOKEN_DERBY_HOME) {
@@ -3386,10 +3932,27 @@ function envCommand(arg) {
 var HELP = `token-derby v${CLI_VERSION}
 
 Identity:
-  token-derby init                        Set up your jockey identity (run this first)
-                                          Re-running renames you on the server.
-  token-derby init --reset                Wipe local identity and create a fresh account.
-                                          Your previous stable is abandoned on the server.
+  token-derby init                        Deprecated \u2014 creates or renames your jockey identity;
+                                          prefer \`login\`, which also links your account.
+  token-derby init --reset                Deprecated \u2014 wipes local identity and starts a fresh
+                                          account (previous stable abandoned); \`login\` recovers
+                                          your existing account instead of abandoning it.
+  token-derby login [--device-name <name>]
+                                          About THIS MACHINE: sign in with Google to give
+                                          it a credential of its own. The way in for a
+                                          machine that has none yet. Adds no email to
+                                          your account \u2014 see \`link\`.
+  token-derby logout                      Retire this machine's credential and clear
+                                          local identity.
+  token-derby link [--device-name <name>]
+                                          About YOUR JOCKEY: connect it to a Google
+                                          account \u2014 adds your email on file, and
+                                          renames your jockey to the first name on
+                                          that account. Then registers this machine
+                                          as a device too, if it is still using the
+                                          shared account credential.
+  token-derby whoami                      Show your jockey name, linked email (if any),
+                                          and this machine's device name (if any).
 
 Maintenance:
   token-derby update                      Check for and install the latest CLI version
@@ -3442,11 +4005,12 @@ async function main() {
     const reset = argv.slice(1).includes("--reset");
     return initCommand(reset);
   }
+  if (cmd === "login") return loginCommand(argv.slice(1));
   if (cmd === "update") return updateCommand();
   if (cmd === "env") return envCommand(argv[1]);
   const identity = await loadIdentity();
   if (!identity) {
-    console.error("Run `token-derby init` to set up your identity before using any other command.");
+    console.error("Run `token-derby login` to set up your identity before using any other command.");
     return 1;
   }
   if (cmd === "stable") {
@@ -3470,6 +4034,9 @@ async function main() {
     const orgName = parseFlag(argv.slice(1), "--organisation");
     return createRaceCommand(orgName);
   }
+  if (cmd === "logout") return logoutCommand();
+  if (cmd === "link") return linkCommand(argv.slice(1));
+  if (cmd === "whoami") return whoamiCommand();
   if (cmd === "join") return joinCommand(argv[1], argv.slice(2));
   if (cmd === "end") return endCommand(argv[1]);
   if (cmd === "roll") return rollCommand();