@mauricode/token-derby 2.13.1 → 3.1.0

package/dist/bin.js

@@ -36,7 +36,9 @@ var CLI_VERSION_HEADER = "x-cli-version";
 var USER_ID_HEADER = "x-user-id";
 var USER_TOKEN_HEADER = "x-user-token";
 var USER_NAME_MAX_LENGTH = 40;
+var SECRET_TOKEN_BYTES = 32;
 var ORG_NAME_PATTERN = /^[A-Za-z0-9]{1,12}$/;
+var DEVICE_LABEL_MAX_LENGTH = 40;
 
 // ../shared/dist/version-match.js
 var SEMVER_RE = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/;
@@ -197,9 +199,31 @@ var HATS = [
   // Claim-only: awarded by an admin, never from a roll. Only the A channel cycles,
   // so the inset motif shifts colour while the cap body stays a static rust brown.
   // The body colour is kept out of the frame list so the motif never merges into it.
-  { id: "contributor_cap", name: "Contributor Cap", rarity: "legendary", width: 11, anchor_x: 23, rows: [".....Q.....", "....QQQ....", "...QQQQQ...", "..QAAAQQQ..", "..QQAQQQQ..", ".QQQAQAAQQ.", ".QQQAQAQAQ.", ".QQQQQAQAQ.", ".QQQQQAAQQ.", ".QQQQQQQQQ."], colors: { A: "#21138b", Q: "#6f2801" }, animation: { type: "cycle", frames: ["#FF8C42", "#E0457B", "#8B5CF6", "#3B82F6", "#22D3EE", "#34D399", "#A3E635", "#FBBF24"], fps: 6 }, rollable: false }
+  { id: "contributor_cap", name: "Contributor Cap", rarity: "legendary", width: 11, anchor_x: 23, rows: [".....Q.....", "....QQQ....", "...QQQQQ...", "..QAAAQQQ..", "..QQAQQQQ..", ".QQQAQAAQQ.", ".QQQAQAQAQ.", ".QQQQQAQAQ.", ".QQQQQAAQQ.", ".QQQQQQQQQ."], colors: { A: "#21138b", Q: "#6f2801" }, animation: { type: "cycle", frames: ["#FF8C42", "#E0457B", "#8B5CF6", "#3B82F6", "#22D3EE", "#34D399", "#A3E635", "#FBBF24"], fps: 6 }, rollable: false },
+  // ── LIMITED (6) ────────────────────────────────────────────────────────
+  // London series. Claim-only by construction: limited is absent from
+  // TIER_WEIGHTS, so no roll can reach this tier.
+  { id: "bearskin", name: "Bearskin", rarity: "limited", width: 11, anchor_x: 23, rows: ["...CCCCC.Q.", "..CAAAAACQ.", "..AAAAAACQ.", "..AAAAAAAQ.", "..AAAAAAA..", "..AAAAAAA..", "..AAAAAAA..", "..AAAAAAA..", "..DDDDDDD..", "..AAAAAAA.."], variants: [{ A: "#23232A", Q: "#C8102E", C: "#15151A", D: "#FFD300" }], rollable: false },
+  { id: "roundel_cap", name: "Roundel Cap", rarity: "limited", width: 11, anchor_x: 23, rows: ["...........", "..AAAAAA...", ".AAAAAAAA..", ".AAQQQQQAA.", ".AAQDDDQAA.", ".AFFFFFFFA.", ".AAQDDDQAA.", ".AAQQQQQAA.", ".AAAAAAAAA.", ".FFFFFFFFFF"], variants: [{ A: "#0B3B8C", Q: "#E32017", C: "#1050B8", D: "#F4F1E8", F: "#072A66" }], rollable: false },
+  { id: "union_topper", name: "Union Topper", rarity: "limited", width: 11, anchor_x: 23, rows: ["..CCCCCCC..", "..AQAAAQA..", "..AAQDQAA..", "..QQQDQQQ..", "..DDDDDDD..", "..QQQDQQQ..", "..AAQDQAA..", "..AQAAAQA..", ".CCCCCCCCC.", ".FFFFFFFFF."], variants: [{ A: "#0B2C6B", Q: "#F2F6FA", C: "#081F4D", D: "#C8102E", F: "#061838" }], rollable: false },
+  { id: "crown_jewels", name: "Crown Jewels", rarity: "limited", width: 11, anchor_x: 23, rows: ["...........", "....QQQ....", ".....Q.....", "..QQ.Q.QQ..", ".Q..QQQ..Q.", ".QCCCQCCCQ.", ".QCCCQCCCQ.", ".QQCCQCCQQ.", "..QQQQQQQ..", "..AAAAAAA.."], variants: [{ A: "#f5f5f5", Q: "#ffd700", C: "#5d0a8a" }], rollable: false },
+  { id: "black_cab", name: "Black Cab", rarity: "limited", width: 11, anchor_x: 22, rows: ["...........", "....CCC....", "..AAAAAA...", "..AQQAQA...", ".AAQQAQAAA.", ".AAAAAAAAAF", "AAAAAAAAAAF", "ADDAAAADDA.", ".DD....DD..", "..........."], variants: [{ A: "#141416", Q: "#8FB8D8", C: "#F5C518", D: "#3A3A40", F: "#D9DDE3" }], rollable: false },
+  { id: "london_bus", name: "London Bus", rarity: "limited", width: 11, anchor_x: 22, rows: ["...........", "...........", ".AAAAAAAAAA", "AAAAAAAAAAA", "ACCCACCCAAC", "AAAAAAAAACC", "ACCCACCCACC", "AAAAAAAAAAA", "AQQAAAAAQQA", ".QQ.....QQ."], variants: [{ A: "#e32402", Q: "#0d0c0c", C: "#dcaf09" }], rollable: false }
 ];
 
+// ../shared/dist/hat-shape.js
+function isAnimatedHat(hat) {
+  return "animation" in hat;
+}
+function hatColors(hat, variantIdx = 0) {
+  if (isAnimatedHat(hat))
+    return hat.colors;
+  return hat.variants[variantIdx] ?? hat.variants[0];
+}
+function channelColor(colors, ch) {
+  return colors[ch] ?? colors.A;
+}
+
 // ../shared/dist/series-transform.js
 var PACE_WINDOW_MS = 15 * 6e4;
 
@@ -289,6 +313,22 @@ var STAMINA_PARAM_BOUNDS = {
   tired_multiplier: { min: 0.2, max: 0.9, step: 0.05, default: STAMINA.TIRED_MULTIPLIER }
 };
 
+// ../shared/dist/devices.js
+var DEVICE_CODE_LENGTH = Math.ceil(SECRET_TOKEN_BYTES * 4 / 3);
+var UNSAFE_LABEL_CHARS = /[\p{Cc}\p{Cf}]/u;
+function validateDeviceLabel(raw) {
+  if (typeof raw !== "string")
+    return { ok: false, message: "label is required" };
+  const label = raw.trim();
+  if (label.length < 1 || label.length > DEVICE_LABEL_MAX_LENGTH) {
+    return { ok: false, message: `label must be 1\u2013${DEVICE_LABEL_MAX_LENGTH} characters` };
+  }
+  if (UNSAFE_LABEL_CHARS.test(label)) {
+    return { ok: false, message: "label may not contain control or invisible characters" };
+  }
+  return { ok: true, label };
+}
+
 // src/ui/HorseSprite.tsx
 import { Box, Text } from "ink";
 
@@ -415,7 +455,7 @@ function composeHatGrid(baseSprite, hat, variantIdx, horseColors) {
       grid[y + ext][x + horseOffsetX] = tagToColor(tag, horseColors);
     }
   }
-  const hatColors = hatColorsFor(hat, variantIdx);
+  const colors = hatColors(hat, variantIdx);
   for (let y = 0; y < hatH; y++) {
     const row = hat.rows[y];
     for (let x = 0; x < hatW; x++) {
@@ -423,7 +463,7 @@ function composeHatGrid(baseSprite, hat, variantIdx, horseColors) {
       if (ch === "." || ch === void 0) continue;
       const gx = hat.anchor_x + x + horseOffsetX;
       if (gx < 0 || gx >= canvasW) continue;
-      const color = ch === "A" ? hatColors.A : hatColors.Q ?? hatColors.A;
+      const color = channelColor(colors, ch);
       grid[y][gx] = color;
     }
   }
@@ -445,10 +485,6 @@ function tagToColor(tag, c) {
       return FIXED_COLORS.H;
   }
 }
-function hatColorsFor(hat, variantIdx) {
-  if (hat.rarity === "legendary") return hat.colors;
-  return hat.variants[variantIdx] ?? hat.variants[0];
-}
 
 // src/ui/half-blocks.ts
 var RESET = "\x1B[0m";
@@ -520,19 +556,19 @@ import { useEffect, useState } from "react";
 import { Box as Box2, Text as Text2 } from "ink";
 import { jsx as jsx2 } from "react/jsx-runtime";
 function AnimatedHorseSprite({ sprite, colors, hat }) {
-  const isLegendary = hat.rarity === "legendary";
-  const frames = isLegendary ? hat.animation.frames : [];
-  const fps = isLegendary ? hat.animation.fps : 1;
+  const animated = isAnimatedHat(hat);
+  const frames = animated ? hat.animation.frames : [];
+  const fps = animated ? hat.animation.fps : 1;
   const [idx, setIdx] = useState(0);
   useEffect(() => {
-    if (!isLegendary || frames.length <= 1) return;
+    if (!animated || frames.length <= 1) return;
     const interval = setInterval(
       () => setIdx((i) => (i + 1) % frames.length),
       Math.max(1, Math.round(1e3 / fps))
     );
     return () => clearInterval(interval);
-  }, [isLegendary, frames.length, fps]);
-  const renderedHat = isLegendary && frames[idx] ? { ...hat, colors: { ...hat.colors, A: frames[idx] } } : hat;
+  }, [animated, frames.length, fps]);
+  const renderedHat = animated && frames[idx] ? { ...hat, colors: { ...hat.colors, A: frames[idx] } } : hat;
   const { grid } = composeHatGrid(sprite, renderedHat, 0, colors);
   const lines = hexGridToHalfBlocks(grid);
   return /* @__PURE__ */ jsx2(Box2, { flexDirection: "column", children: lines.map((line, i) => /* @__PURE__ */ jsx2(Text2, { children: line }, i)) });
@@ -721,7 +757,7 @@ function HorseCreator({
         "]"
       ] })
     ] }),
-    /* @__PURE__ */ jsx3(Box3, { marginBottom: 1, children: previewHatDef ? previewHatDef.rarity === "legendary" ? /* @__PURE__ */ jsx3(AnimatedHorseSprite, { sprite: MAIN_SPRITE, colors, hat: previewHatDef }) : /* @__PURE__ */ jsx3(HorseSprite, { sprite: MAIN_SPRITE, colors, hat: { hat: previewHatDef, variant: previewHat?.variant ?? 0 } }) : /* @__PURE__ */ jsx3(HorseSprite, { sprite: MAIN_SPRITE, colors }) }),
+    /* @__PURE__ */ jsx3(Box3, { marginBottom: 1, children: previewHatDef ? isAnimatedHat(previewHatDef) ? /* @__PURE__ */ jsx3(AnimatedHorseSprite, { sprite: MAIN_SPRITE, colors, hat: previewHatDef }) : /* @__PURE__ */ jsx3(HorseSprite, { sprite: MAIN_SPRITE, colors, hat: { hat: previewHatDef, variant: previewHat?.variant ?? 0 } }) : /* @__PURE__ */ jsx3(HorseSprite, { sprite: MAIN_SPRITE, colors }) }),
     /* @__PURE__ */ jsx3(Box3, { flexDirection: "column", children: rows.map((r, i) => {
       const cursor = i === rowIdx ? "\u25BA" : " ";
       if (r.kind === "color") {
@@ -767,8 +803,8 @@ function renderHatLabel(hats, hatChoice, initialEquipped) {
   if (!collected) return /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "?" });
   const hat = hatById(collected.id);
   const name = hat?.name ?? collected.id;
-  const variantSuffix = hat && hat.rarity !== "legendary" && collected.variant !== void 0 ? ` #${collected.variant + 1}` : "";
-  const rarityColor = hat ? hat.rarity === "legendary" ? "yellow" : hat.rarity === "epic" ? "magenta" : hat.rarity === "rare" ? "blue" : "gray" : "gray";
+  const variantSuffix = hat && !isAnimatedHat(hat) && collected.variant !== void 0 ? ` #${collected.variant + 1}` : "";
+  const rarityColor = hat ? hat.rarity === "limited" ? "magentaBright" : hat.rarity === "legendary" ? "yellow" : hat.rarity === "epic" ? "magenta" : hat.rarity === "rare" ? "blue" : "gray" : "gray";
   const equippedMark = initialEquipped === hatChoice ? " \u2713" : "";
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     name,
@@ -825,8 +861,8 @@ var HEARTBEAT_RETRY_DELAYS_MS = [1e3, 2e3, 4e3, 8e3, 15e3];
 // src/version.ts
 import { createRequire } from "module";
 function readVersion() {
-  if ("2.13.1".length > 0) {
-    return "2.13.1";
+  if ("3.1.0".length > 0) {
+    return "3.1.0";
   }
   try {
     const req = createRequire(import.meta.url);
@@ -871,18 +907,37 @@ function geminiTmpDir() {
 }
 
 // src/identity/identity.ts
-async function loadIdentity() {
+async function readIdentityFile() {
+  let raw;
   try {
-    const raw = await fs.readFile(identityFile(), "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed.user_id === "string" && typeof parsed.display_name === "string" && typeof parsed.secret_token === "string" && typeof parsed.created_at === "string") {
-      return parsed;
-    }
-    return null;
+    raw = await fs.readFile(identityFile(), "utf8");
   } catch (e) {
-    if (e?.code === "ENOENT") return null;
-    return null;
+    if (e?.code === "ENOENT") return { kind: "missing" };
+    return { kind: "unreadable", reason: `could not be read (${e?.code ?? "read error"})` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { kind: "unreadable", reason: "is not valid JSON" };
   }
+  if (!isPlainObject(parsed)) {
+    return { kind: "unreadable", reason: "does not contain an identity object" };
+  }
+  if (typeof parsed.user_id === "string" && typeof parsed.display_name === "string" && typeof parsed.secret_token === "string" && typeof parsed.created_at === "string") {
+    return { kind: "ok", identity: parsed };
+  }
+  if (!("secret_token" in parsed)) {
+    return { kind: "no-credential", reason: "holds no credential this version can use" };
+  }
+  return { kind: "unreadable", reason: "is missing fields this version expects" };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function loadIdentity() {
+  const state = await readIdentityFile();
+  return state.kind === "ok" ? state.identity : null;
 }
 async function saveIdentity(identity) {
   await fs.mkdir(homeDir(), { recursive: true });
@@ -923,12 +978,12 @@ function getIdentity() {
 function _resetIdentityCacheForTests() {
   identityCache = null;
 }
-async function request(method, path9, body, horseAuthToken, fetchImpl = fetch) {
+async function request(method, path9, body, horseAuthToken, fetchImpl = fetch, identityOverride) {
   const url = path9.startsWith("http") ? path9 : `${apiBase()}${path9}`;
   const headers = {};
   headers[CLI_VERSION_HEADER] = CLI_VERSION;
   headers["user-agent"] = `token-derby/${CLI_VERSION}`;
-  const identity = await getIdentity();
+  const identity = identityOverride ?? await getIdentity();
   if (identity) {
     headers[USER_ID_HEADER] = identity.user_id;
     headers[USER_TOKEN_HEADER] = identity.secret_token;
@@ -994,6 +1049,9 @@ function listOrganisations() {
 function initJockey(body) {
   return request("POST", "/jockey/init", body, void 0);
 }
+function getJockey() {
+  return request("GET", "/jockey/me", void 0, void 0);
+}
 function updateJockey(body) {
   return request("PUT", "/jockey/me", body, void 0);
 }
@@ -1034,6 +1092,28 @@ function probeClaim(code) {
 function redeemClaim(code, body) {
   return request("POST", `/claims/${encodeURIComponent(code)}/redeem`, body, void 0);
 }
+function cliAuthStart(body) {
+  return request("POST", "/auth/cli/start", body, void 0);
+}
+function cliAuthPoll(body) {
+  return request("POST", "/auth/cli/poll", body, void 0);
+}
+function revokeDevice(deviceId, auth) {
+  return request(
+    "DELETE",
+    `/devices/${encodeURIComponent(deviceId)}`,
+    void 0,
+    void 0,
+    void 0,
+    auth
+  );
+}
+function registerDevice(body) {
+  return request("POST", "/devices", body, void 0);
+}
+function logoutDevice() {
+  return request("DELETE", "/devices/me", void 0, void 0);
+}
 
 // src/commands/stable-create.ts
 async function stableCreateCommand() {
@@ -2461,7 +2541,7 @@ async function joinCommand(joinCode, argv = []) {
   }
   const identity = await loadIdentity();
   if (!identity) {
-    console.error("Run `token-derby init` to set up your identity.");
+    console.error("Run `token-derby login` to set up your identity.");
     return 1;
   }
   let race;
@@ -2634,72 +2714,346 @@ async function endCommand(adminCode) {
 // src/commands/init.ts
 import * as readline4 from "readline/promises";
 import { stdin as stdin4, stdout as stdout4 } from "process";
-async function initCommand(reset = false) {
-  if (reset) {
-    await deleteIdentity();
-    _resetIdentityCacheForTests();
-    console.log("Removed local identity. Creating a new one\u2026");
-  }
-  const existing = await loadIdentity();
+async function defaultPromptText(question) {
   const rl = readline4.createInterface({ input: stdin4, output: stdout4 });
   try {
-    if (existing) {
-      console.log(`Current jockey name: ${existing.display_name}`);
-      const raw2 = (await rl.question("New jockey name (use your real name please) [keep]: ")).trim();
-      if (!raw2) {
-        console.log("Kept existing name.");
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+async function initCommand(reset = false, deps = {}) {
+  const loadIdentity2 = deps.loadIdentity ?? loadIdentity;
+  const saveIdentity2 = deps.saveIdentity ?? saveIdentity;
+  const deleteIdentity2 = deps.deleteIdentity ?? deleteIdentity;
+  const readIdentityFile2 = deps.readIdentityFile ?? readIdentityFile;
+  const initJockey2 = deps.initJockey ?? initJockey;
+  const updateJockey2 = deps.updateJockey ?? updateJockey;
+  const apiGetJockey = deps.apiGetJockey ?? getJockey;
+  const promptText = deps.promptText ?? defaultPromptText;
+  const isTTY = deps.isTTY ?? Boolean(process.stdin.isTTY);
+  console.log("");
+  console.log(
+    "Heads up: `token-derby login` is becoming the only way to manage accounts on this machine. `init` still works today, but plan to move over."
+  );
+  console.log("");
+  if (reset) {
+    const current = await readIdentityFile2();
+    if (current.kind !== "missing") {
+      if (current.kind === "ok") {
+        console.log(`About to abandon jockey: ${current.identity.display_name}`);
+      } else if (current.kind === "unreadable") {
+        console.log(`About to delete identity.json, which ${current.reason}.`);
+        console.log("The credential inside cannot be read, so there is no way to tell which jockey");
+        console.log("this is, or whether anything else can still recover it.");
+      } else {
+        console.log(`About to delete identity.json, which ${current.reason}.`);
+      }
+      console.log("This deletes the local identity only \u2014 the account itself stays on the server.");
+      if (current.kind === "ok") {
+        try {
+          const me = await apiGetJockey();
+          if (me.device_label) {
+            console.log(`  This machine's credential, "${me.device_label}", will stay live on the`);
+            console.log("  abandoned account and can only be revoked from the Account view in the org manager.");
+          }
+          if (me.email) {
+            console.log("  This account has a Google account linked \u2014 `token-derby login` would recover");
+            console.log("  this same jockey instead of abandoning it.");
+          }
+        } catch {
+        }
+      }
+      if (!isTTY) {
+        console.error("");
+        console.error("Refusing to reset without a terminal to confirm \u2014 this is irreversible.");
+        console.error(
+          "Run `token-derby init --reset` interactively, or use `token-derby login` to recover this jockey instead."
+        );
+        return 1;
+      }
+      const answer = (await promptText('Type "yes" to abandon this jockey [no]: ')).trim().toLowerCase();
+      if (answer !== "yes") {
+        console.log("Reset cancelled. Nothing was deleted.");
         return 0;
       }
-      const v2 = validateDisplayName(raw2);
-      if (!v2.ok) {
-        console.error(v2.error);
+    }
+    await deleteIdentity2();
+    _resetIdentityCacheForTests();
+    console.log("Removed local identity. Creating a new one\u2026");
+  }
+  if (!reset) {
+    const state = await readIdentityFile2();
+    if (state.kind === "unreadable") {
+      console.error(`Your local identity file ${state.reason}.`);
+      console.error("It may hold a credential that cannot be recovered, so this will not overwrite it.");
+      console.error("Run `token-derby login` to sign in fresh, or `token-derby init --reset` to discard it.");
+      return 1;
+    }
+    if (state.kind === "no-credential") {
+      console.log(`Your local identity file ${state.reason}, so this will replace it.`);
+    }
+  }
+  const existing = await loadIdentity2();
+  if (existing) {
+    console.log(`Current jockey name: ${existing.display_name}`);
+    const raw2 = (await promptText("New jockey name (use your real name please) [keep]: ")).trim();
+    if (!raw2) {
+      console.log("Kept existing name.");
+      return 0;
+    }
+    const v2 = validateDisplayName(raw2);
+    if (!v2.ok) {
+      console.error(v2.error);
+      return 1;
+    }
+    try {
+      const resp = await updateJockey2({ display_name: v2.name });
+      const updated = { ...existing, display_name: resp.display_name };
+      await saveIdentity2(updated);
+      console.log(`Updated jockey name to: ${updated.display_name}`);
+      return 0;
+    } catch (e) {
+      if (e instanceof ApiError) {
+        if (e.code === "UNAUTHENTICATED") {
+          console.error(
+            "Server does not recognise this identity. Your account may have been wiped. Run `token-derby init --reset` to start fresh."
+          );
+        } else {
+          console.error(`Error: ${e.code} ${e.message}`);
+        }
         return 1;
       }
-      try {
-        const resp = await updateJockey({ display_name: v2.name });
-        const updated = { ...existing, display_name: resp.display_name };
-        await saveIdentity(updated);
-        console.log(`Updated jockey name to: ${updated.display_name}`);
+      throw e;
+    }
+  }
+  const raw = (await promptText("Jockey Name (use your real name please): ")).trim();
+  const v = validateDisplayName(raw);
+  if (!v.ok) {
+    console.error(v.error);
+    return 1;
+  }
+  try {
+    const resp = await initJockey2({ display_name: v.name });
+    const identity = {
+      user_id: resp.user_id,
+      display_name: resp.display_name,
+      secret_token: resp.secret_token,
+      created_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await saveIdentity2(identity);
+    _resetIdentityCacheForTests();
+    console.log("");
+    console.log(`Welcome, ${identity.display_name}!`);
+    console.log("Your identity has been created on the server.");
+    console.log("You can now create a stable and join races.");
+    console.log("");
+    console.log("  \u26A0  Your secret token is stored locally in identity.json.");
+    console.log("     If you lose it, you cannot recover this account \u2014 you would");
+    console.log("     need to run `token-derby init --reset` and rebuild your stable.");
+    return 0;
+  } catch (e) {
+    if (e instanceof ApiError) {
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+}
+
+// src/commands/login.ts
+import { spawn as spawn2 } from "child_process";
+import * as os3 from "os";
+
+// src/commands/web.ts
+import { spawn } from "child_process";
+function webOrigin() {
+  return apiBase().replace(/\/api\/?$/, "");
+}
+function opener() {
+  if (process.platform === "darwin") return "open";
+  if (process.platform === "win32") return "start";
+  if (process.platform === "linux") return "xdg-open";
+  return null;
+}
+async function webCommand(deps = {}) {
+  const spawnImpl = deps.spawnImpl ?? spawn;
+  let code;
+  try {
+    ({ code } = await createWebSession());
+  } catch (e) {
+    if (e instanceof ApiError) {
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+  const url = `${webOrigin()}/org-manager#code=${code}`;
+  console.log("");
+  console.log("  Opening the Token Derby org manager in your browser...");
+  console.log(`  ${url}`);
+  console.log("");
+  console.log("  If it doesn't open, copy the link above. It expires in 60 seconds.");
+  const cmd = opener();
+  if (cmd) {
+    try {
+      const child = spawnImpl(cmd, [url], { stdio: "ignore", detached: true });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
+    }
+  }
+  return 0;
+}
+
+// src/ui/prompt.ts
+async function promptYesNo(question) {
+  resetStdinAfterInk();
+  const readline6 = await import("readline/promises");
+  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
+  const a = (await rl.question(question)).trim().toLowerCase();
+  rl.close();
+  return a === "" || a === "y" || a === "yes";
+}
+function resetStdinAfterInk() {
+  if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
+    process.stdin.setRawMode(false);
+  }
+  while (process.stdin.read() !== null) {
+  }
+  process.stdin.pause();
+  process.stdin.ref();
+}
+
+// src/commands/login.ts
+function parseDeviceNameFlag(argv) {
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--device-name") return argv[i + 1] ?? null;
+    if (a.startsWith("--device-name=")) return a.slice("--device-name=".length);
+  }
+  return null;
+}
+async function defaultPromptText2(question) {
+  const readline6 = await import("readline/promises");
+  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function resolveDeviceName(flagName, isTTY, hostname3, promptText) {
+  if (flagName) return flagName;
+  if (!isTTY) return hostname3;
+  const answer = (await promptText(`Device name [${hostname3}]: `)).trim();
+  return answer || hostname3;
+}
+async function loginCommand(argv = [], deps = {}) {
+  const apiStart = deps.apiStart ?? cliAuthStart;
+  const apiPoll = deps.apiPoll ?? cliAuthPoll;
+  const apiRevokeDevice = deps.apiRevokeDevice ?? revokeDevice;
+  const apiCreateWebSession = deps.apiCreateWebSession ?? createWebSession;
+  const saveIdentity2 = deps.saveIdentity ?? saveIdentity;
+  const loadIdentity2 = deps.loadIdentity ?? loadIdentity;
+  const promptText = deps.promptText ?? defaultPromptText2;
+  const promptYesNo2 = deps.promptYesNo ?? promptYesNo;
+  const sleepImpl = deps.sleepImpl ?? defaultSleep;
+  const isTTY = deps.isTTY ?? Boolean(process.stdin.isTTY);
+  const spawnImpl = deps.spawnImpl ?? spawn2;
+  const hostname3 = deps.hostname ?? (() => os3.hostname());
+  const existing = await loadIdentity2();
+  if (existing) {
+    console.log("");
+    console.log(`  This machine is already signed in as ${existing.display_name}.`);
+    console.log("  Signing in again adds a second credential; the current one stays active");
+    console.log("  until you revoke it under Account in the org manager (`token-derby web`).");
+    if (isTTY) {
+      if (!await promptYesNo2("  Sign in again anyway? [Y/n] ")) {
+        console.log("Login cancelled.");
         return 0;
-      } catch (e) {
-        if (e instanceof ApiError) {
-          if (e.code === "UNAUTHENTICATED") {
-            console.error(
-              "Server does not recognise this identity. Your account may have been wiped. Run `token-derby init --reset` to start fresh."
-            );
-          } else {
-            console.error(`Error: ${e.code} ${e.message}`);
-          }
+      }
+    } else {
+      console.log("  No TTY to confirm \u2014 continuing (equivalent to answering Y).");
+    }
+  }
+  let label = await resolveDeviceName(parseDeviceNameFlag(argv), isTTY, hostname3(), promptText);
+  let start;
+  for (; ; ) {
+    try {
+      start = await apiStart({ label });
+      break;
+    } catch (e) {
+      if (e instanceof ApiError && e.code === "BAD_REQUEST") {
+        console.error(`Error: ${e.message}`);
+        if (!isTTY) return 1;
+        const retry = (await promptText("Enter a different device name: ")).trim();
+        if (!retry) {
+          console.error("Device name cannot be empty.");
           return 1;
         }
+        label = retry;
+        continue;
+      }
+      if (e instanceof ApiError) {
+        console.error(`Error: ${e.code} ${e.message}`);
+        return 1;
+      }
+      throw e;
+    }
+  }
+  let verificationUrl = start.verification_uri;
+  let hasGrant = false;
+  if (existing) {
+    try {
+      const grant = await apiCreateWebSession();
+      verificationUrl = `${start.verification_uri}#code=${grant.code}`;
+      hasGrant = true;
+    } catch (e) {
+      if (e instanceof ApiError && e.code === "UNAUTHENTICATED") {
+        console.log("");
+        console.log("  The credential stored on this machine is no longer valid (it may have been");
+        console.log("  revoked), so this will sign you in fresh in the browser.");
+      } else if (e instanceof ApiError) {
+        console.error(`Error: ${e.code} ${e.message}`);
+        return 1;
+      } else {
         throw e;
       }
     }
-    const raw = (await rl.question("Jockey Name (use your real name please): ")).trim();
-    const v = validateDisplayName(raw);
-    if (!v.ok) {
-      console.error(v.error);
-      return 1;
+  }
+  console.log("");
+  console.log("  To finish signing in, visit:");
+  console.log(`    ${verificationUrl}`);
+  if (hasGrant) {
+    console.log("    That link signs the browser in for you and expires in 60 seconds \u2014 if it");
+    console.log("    does, run `token-derby login` again for a fresh one.");
+  }
+  console.log("");
+  console.log("  And enter this code:");
+  console.log(`    ${start.user_code}`);
+  console.log("");
+  console.log("  Waiting for approval...");
+  const cmd = opener();
+  if (cmd) {
+    try {
+      const child = spawnImpl(cmd, [verificationUrl], { stdio: "ignore", detached: true });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
     }
+  }
+  const deadline = Date.now() + start.expires_in * 1e3;
+  let approved = null;
+  while (!approved) {
+    let poll;
     try {
-      const resp = await initJockey({ display_name: v.name });
-      const identity = {
-        user_id: resp.user_id,
-        display_name: resp.display_name,
-        secret_token: resp.secret_token,
-        created_at: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      await saveIdentity(identity);
-      _resetIdentityCacheForTests();
-      console.log("");
-      console.log(`Welcome, ${identity.display_name}!`);
-      console.log("Your identity has been created on the server.");
-      console.log("You can now create a stable and join races.");
-      console.log("");
-      console.log("  \u26A0  Your secret token is stored locally in identity.json.");
-      console.log("     If you lose it, you cannot recover this account \u2014 you would");
-      console.log("     need to run `token-derby init --reset` and rebuild your stable.");
-      return 0;
+      poll = await apiPoll({ device_code: start.device_code });
     } catch (e) {
       if (e instanceof ApiError) {
         console.error(`Error: ${e.code} ${e.message}`);
@@ -2707,21 +3061,292 @@ async function initCommand(reset = false) {
       }
       throw e;
     }
+    if (poll.status === "approved") {
+      approved = poll;
+      break;
+    }
+    if (Date.now() >= deadline) {
+      console.error("Login timed out waiting for approval. Run `token-derby login` again.");
+      return 1;
+    }
+    await sleepImpl(start.interval * 1e3);
+  }
+  console.log("");
+  if (approved.email) console.log(`  \u2713 Signed in as ${approved.email}`);
+  console.log(
+    `    Linking to your existing jockey: ${approved.display_name} (${approved.horses} horses, ${approved.orgs} orgs)`
+  );
+  let proceed;
+  if (isTTY) {
+    proceed = await promptYesNo2("    Link this account? [Y/n] ");
+  } else {
+    console.log("    No TTY to confirm \u2014 proceeding automatically (equivalent to answering Y).");
+    proceed = true;
+  }
+  if (!proceed) {
+    try {
+      await apiRevokeDevice(approved.device_id, { user_id: approved.user_id, secret_token: approved.secret_token });
+    } catch (e) {
+      console.error("Declined, but could not revoke the device credential on the server.");
+      if (e instanceof ApiError) console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    console.log("Login cancelled.");
+    return 0;
+  }
+  const identity = {
+    user_id: approved.user_id,
+    display_name: approved.display_name,
+    secret_token: approved.secret_token,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await saveIdentity2(identity);
+  console.log("");
+  console.log(`Welcome back, ${identity.display_name}!`);
+  return 0;
+}
+
+// src/commands/logout.ts
+async function logoutCommand(deps = {}) {
+  const apiLogoutDevice = deps.apiLogoutDevice ?? logoutDevice;
+  const deleteIdentity2 = deps.deleteIdentity ?? deleteIdentity;
+  try {
+    const result = await apiLogoutDevice();
+    if (result.revoked) {
+      console.log("Revoked this device's credential on the server.");
+    } else {
+      console.log(
+        "This machine is signed in with a legacy account credential (never linked via `token-derby login`), so there is no separate device credential to revoke."
+      );
+    }
+  } catch (e) {
+    if (e instanceof ApiError && e.code === "UNAUTHENTICATED") {
+      console.error("This device credential was already invalid on the server \u2014 clearing it locally too.");
+      await deleteIdentity2();
+      console.log("Removed local identity. You are signed out.");
+      return 0;
+    }
+    if (e instanceof ApiError) {
+      console.error(`Error: ${e.code} ${e.message}`);
+      console.error("Local identity left in place \u2014 run `token-derby logout` again to retry.");
+      return 1;
+    }
+    throw e;
+  }
+  await deleteIdentity2();
+  console.log("Removed local identity. You are signed out.");
+  return 0;
+}
+
+// src/commands/link.ts
+import { spawn as spawn3 } from "child_process";
+import * as os4 from "os";
+
+// src/ui/messages.ts
+var CREDENTIAL_DEAD_MESSAGE = "This machine's credential is no longer valid on the server \u2014 it may have been revoked.\nRun `token-derby login` to sign this machine in again.";
+
+// src/commands/link.ts
+function defaultSleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function defaultPromptText3(question) {
+  const readline6 = await import("readline/promises");
+  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
   } finally {
     rl.close();
   }
 }
+var POLL_INTERVAL_MS = 2e3;
+var WAIT_TIMEOUT_MS = 5 * 60 * 1e3;
+async function linkCommand(argv = [], deps = {}) {
+  const apiGetJockey = deps.apiGetJockey ?? getJockey;
+  const apiCreateWebSession = deps.apiCreateWebSession ?? createWebSession;
+  const apiRegisterDevice = deps.apiRegisterDevice ?? registerDevice;
+  const loadIdentity2 = deps.loadIdentity ?? loadIdentity;
+  const saveIdentity2 = deps.saveIdentity ?? saveIdentity;
+  const spawnImpl = deps.spawnImpl ?? spawn3;
+  const sleepImpl = deps.sleepImpl ?? defaultSleep2;
+  const promptText = deps.promptText ?? defaultPromptText3;
+  const isTTY = deps.isTTY ?? Boolean(process.stdin.isTTY);
+  const hostname3 = deps.hostname ?? (() => os4.hostname());
+  const flagName = parseDeviceNameFlag(argv);
+  if (flagName !== null) {
+    const checked = validateDeviceLabel(flagName);
+    if (!checked.ok) {
+      console.error(`Error: invalid --device-name: ${checked.message}`);
+      return 1;
+    }
+  }
+  const syncLocalName = async (serverName) => {
+    const local = await loadIdentity2();
+    if (!local || local.display_name === serverName) return;
+    await saveIdentity2({ ...local, display_name: serverName });
+  };
+  const registerThisMachine = async (linked) => {
+    const serverName = linked.display_name;
+    if (linked.device_label) {
+      await syncLocalName(serverName);
+      console.log(`  This machine already has its own credential, "${linked.device_label}", so it`);
+      console.log("  was not registered again \u2014 a second one would leave the first live with");
+      console.log("  nothing on this machine holding it.");
+      return;
+    }
+    const local = await loadIdentity2();
+    if (!local) {
+      console.log("  This machine has no local identity file, so it was not registered as a");
+      console.log("  device. Run `token-derby login` to give it its own credential.");
+      return;
+    }
+    const named = local.display_name === serverName ? local : { ...local, display_name: serverName };
+    let label;
+    try {
+      label = await resolveDeviceName(flagName, isTTY, hostname3(), promptText);
+      for (; ; ) {
+        try {
+          const registered = await apiRegisterDevice({ label });
+          await saveIdentity2({ ...named, secret_token: registered.secret_token });
+          break;
+        } catch (e) {
+          if (!(e instanceof ApiError && e.code === "BAD_REQUEST" && isTTY)) throw e;
+          console.error(`  Error: ${e.message}`);
+          const retry = (await promptText("  Enter a different device name: ")).trim();
+          if (!retry) throw e;
+          label = retry;
+        }
+      }
+    } catch (e) {
+      try {
+        if (named !== local) await saveIdentity2(named);
+      } catch {
+      }
+      console.log("");
+      console.log("  Your account is linked \u2014 that part is done and does not need repeating.");
+      console.log("  Registering this machine as a device did not complete, so it is still");
+      console.log("  using the shared account credential. Run `token-derby login` to finish.");
+      console.error(`  Error: ${e instanceof ApiError ? `${e.code} ${e.message}` : String(e)}`);
+      return;
+    }
+    console.log(`  This machine is now registered as "${label}", with a credential of its own`);
+    console.log("  that you can revoke separately under Account in the org manager.");
+  };
+  let me;
+  try {
+    me = await apiGetJockey();
+  } catch (e) {
+    if (e instanceof ApiError) {
+      if (e.code === "UNAUTHENTICATED") {
+        console.error(CREDENTIAL_DEAD_MESSAGE);
+        return 1;
+      }
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+  if (me.email) {
+    console.log(`Already linked to ${me.email}.`);
+    await syncLocalName(me.display_name);
+    return 0;
+  }
+  let code;
+  try {
+    ({ code } = await apiCreateWebSession());
+  } catch (e) {
+    if (e instanceof ApiError) {
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+  const url = `${webOrigin()}/link#code=${code}`;
+  console.log("");
+  console.log("  Opening the Google link page in your browser...");
+  console.log(`  ${url}`);
+  console.log("");
+  console.log("  If it doesn't open, copy the link above. It expires in 60 seconds.");
+  const cmd = opener();
+  if (cmd) {
+    try {
+      const child = spawnImpl(cmd, [url], { stdio: "ignore", detached: true });
+      child.on("error", () => {
+      });
+      child.unref();
+    } catch {
+    }
+  }
+  console.log("");
+  console.log("  Waiting for you to finish connecting with Google...");
+  const deadline = Date.now() + WAIT_TIMEOUT_MS;
+  for (; ; ) {
+    let poll;
+    try {
+      poll = await apiGetJockey();
+    } catch (e) {
+      if (e instanceof ApiError) {
+        if (e.code === "UNAUTHENTICATED") {
+          console.error(CREDENTIAL_DEAD_MESSAGE);
+          return 1;
+        }
+        console.error(`Error: ${e.code} ${e.message}`);
+        return 1;
+      }
+      throw e;
+    }
+    if (poll.email) {
+      console.log(`\u2713 Linked to ${poll.email}.`);
+      if (poll.display_name !== me.display_name) {
+        console.log(`  Your jockey is now named ${poll.display_name} \u2014 a first link renames it to`);
+        console.log("  the first name on the Google account. `token-derby init` renames it again");
+        console.log("  if you would rather it said something else.");
+      }
+      await registerThisMachine(poll);
+      return 0;
+    }
+    if (Date.now() >= deadline) {
+      console.error("Timed out waiting for the Google link to complete. Run `token-derby link` again.");
+      return 1;
+    }
+    await sleepImpl(POLL_INTERVAL_MS);
+  }
+}
+
+// src/commands/whoami.ts
+async function whoamiCommand(deps = {}) {
+  const apiGetJockey = deps.apiGetJockey ?? getJockey;
+  let me;
+  try {
+    me = await apiGetJockey();
+  } catch (e) {
+    if (e instanceof ApiError) {
+      if (e.code === "UNAUTHENTICATED") {
+        console.error(CREDENTIAL_DEAD_MESSAGE);
+        return 1;
+      }
+      console.error(`Error: ${e.code} ${e.message}`);
+      return 1;
+    }
+    throw e;
+  }
+  console.log("");
+  console.log(`  ${me.display_name}`);
+  if (me.email) console.log(`  ${me.email}`);
+  if (me.device_label) console.log(`  this machine: ${me.device_label}`);
+  console.log("");
+  return 0;
+}
 
 // src/commands/update.ts
 import * as readline5 from "readline/promises";
 import { stdin as stdin5, stdout as stdout5 } from "process";
-import { spawn } from "child_process";
+import { spawn as spawn4 } from "child_process";
 var REGISTRY_URL = "https://registry.npmjs.org/@mauricode/token-derby/latest";
 var UPGRADE_CMD = "npm install -g @mauricode/token-derby@latest";
 var FETCH_TIMEOUT_MS = 5e3;
 async function updateCommand(deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const spawnImpl = deps.spawnImpl ?? spawn;
+  const spawnImpl = deps.spawnImpl ?? spawn4;
   const promptYesNo2 = deps.promptYesNo ?? defaultPromptYesNo;
   let latest;
   try {
@@ -2857,25 +3482,6 @@ function RollHorsePicker({ horses, onPick, onCancel }) {
   ] });
 }
 
-// src/ui/prompt.ts
-async function promptYesNo(question) {
-  resetStdinAfterInk();
-  const readline6 = await import("readline/promises");
-  const rl = readline6.createInterface({ input: process.stdin, output: process.stdout });
-  const a = (await rl.question(question)).trim().toLowerCase();
-  rl.close();
-  return a === "" || a === "y" || a === "yes";
-}
-function resetStdinAfterInk() {
-  if (process.stdin.isTTY && typeof process.stdin.setRawMode === "function") {
-    process.stdin.setRawMode(false);
-  }
-  while (process.stdin.read() !== null) {
-  }
-  process.stdin.pause();
-  process.stdin.ref();
-}
-
 // src/ui/reveal.ts
 import React13 from "react";
 import { render as render5 } from "ink";
@@ -2889,13 +3495,13 @@ import { useEffect as useEffect3, useState as useState7 } from "react";
 import { Box as Box10, Text as Text10 } from "ink";
 import { jsx as jsx10 } from "react/jsx-runtime";
 function HatSprite({ hat, variant, centerIn }) {
-  const colors = hatColorsFor2(hat, variant ?? 0);
+  const colors = hatColors(hat, variant ?? 0);
   const grid = makeHatGrid(hat, colors, centerIn);
   const lines = hexGridToHalfBlocks(grid);
   return /* @__PURE__ */ jsx10(Box10, { flexDirection: "column", children: lines.map((line, i) => /* @__PURE__ */ jsx10(Text10, { children: line }, i)) });
 }
 function AnimatedHatSprite({ hat, variant, centerIn }) {
-  if (hat.rarity !== "legendary") {
+  if (!isAnimatedHat(hat)) {
     return /* @__PURE__ */ jsx10(HatSprite, { hat, variant, centerIn });
   }
   const frames = hat.animation.frames;
@@ -2912,10 +3518,6 @@ function AnimatedHatSprite({ hat, variant, centerIn }) {
   const framed = { ...hat, colors: { ...hat.colors, A: frames[idx] } };
   return /* @__PURE__ */ jsx10(HatSprite, { hat: framed, variant, centerIn });
 }
-function hatColorsFor2(hat, variantIdx) {
-  if (hat.rarity === "legendary") return hat.colors;
-  return hat.variants[variantIdx] ?? hat.variants[0];
-}
 function makeHatGrid(hat, colors, centerIn) {
   const w = centerIn?.w ?? hat.width;
   const h = centerIn?.h ?? hat.rows.length;
@@ -2930,7 +3532,7 @@ function makeHatGrid(hat, colors, centerIn) {
       const gx = x + offX;
       const gy = y + offY;
       if (gx < 0 || gx >= w || gy < 0 || gy >= h) continue;
-      grid[gy][gx] = ch === "A" ? colors.A : colors.Q ?? colors.A;
+      grid[gy][gx] = channelColor(colors, ch);
     }
   }
   return grid;
@@ -2944,7 +3546,8 @@ var TIER_PALETTE = {
   common: ["#FFFFFF", "#DDDDDD", "#AAAAAA", "#9E9E9E"],
   rare: ["#42A5F5", "#1E88E5", "#90CAF9", "#0277BD"],
   epic: ["#AB47BC", "#8E24AA", "#CE93D8", "#6A1B9A"],
-  legendary: ["#FFD700", "#FF7F00", "#FF0000", "#FF00FF", "#00BFFF", "#7CFC00", "#8B00FF"]
+  legendary: ["#FFD700", "#FF7F00", "#FF0000", "#FF00FF", "#00BFFF", "#7CFC00", "#8B00FF"],
+  limited: ["#F472B6", "#EC4899", "#FF4FA3", "#FBCFE8", "#FFFFFF"]
 };
 var CONFETTI_CHARS = ["\u2726", "\u2727", "\u22C6", "\u2605", "\u2606", "\u2728", "*", "\u2022", "\u25C6", "\u25C7"];
 var SCENE_W = 32;
@@ -3047,7 +3650,7 @@ function ConfettiBurst({ tier }) {
 var CLOSED_HOLD_MS = 3e3;
 function RollReveal({ outcome, onDone }) {
   const isNoHat = outcome.kind === "no_hat";
-  const isLegendary = outcome.kind !== "no_hat" && outcome.hat.rarity === "legendary";
+  const isShowpiece = outcome.kind !== "no_hat" && (outcome.hat.rarity === "legendary" || outcome.hat.rarity === "limited");
   const [phase, setPhase] = useState8("closed");
   useEffect4(() => {
     const timers = [];
@@ -3059,10 +3662,10 @@ function RollReveal({ outcome, onDone }) {
     } else {
       timers.push(setTimeout(() => setPhase("burst"), CLOSED_HOLD_MS + 700));
       timers.push(setTimeout(() => setPhase("reveal"), CLOSED_HOLD_MS + 1650));
-      timers.push(setTimeout(onDone, CLOSED_HOLD_MS + (isLegendary ? 4650 : 2650)));
+      timers.push(setTimeout(onDone, CLOSED_HOLD_MS + (isShowpiece ? 4650 : 2650)));
     }
     return () => timers.forEach(clearTimeout);
-  }, [isNoHat, isLegendary, onDone]);
+  }, [isNoHat, isShowpiece, onDone]);
   if (phase === "closed") return /* @__PURE__ */ jsx11(GiftBox, { frame: BOX_CLOSED, color: BOX_COLOR });
   if (phase === "open1") return /* @__PURE__ */ jsx11(GiftBox, { frame: BOX_OPENING_1, color: BOX_COLOR });
   if (phase === "open2") return /* @__PURE__ */ jsx11(GiftBox, { frame: BOX_OPENING_2, color: BOX_COLOR });
@@ -3071,7 +3674,7 @@ function RollReveal({ outcome, onDone }) {
     return /* @__PURE__ */ jsx11(ConfettiBurst, { tier: outcome.hat.rarity });
   }
   if (outcome.kind === "no_hat") return /* @__PURE__ */ jsx11(GiftBox, { frame: BOX_EMPTY, color: BOX_COLOR });
-  return outcome.hat.rarity === "legendary" ? /* @__PURE__ */ jsx11(AnimatedHatSprite, { hat: outcome.hat, centerIn: { w: SCENE_W, h: SCENE_H } }) : /* @__PURE__ */ jsx11(HatSprite, { hat: outcome.hat, variant: outcome.variant, centerIn: { w: SCENE_W, h: SCENE_H } });
+  return isAnimatedHat(outcome.hat) ? /* @__PURE__ */ jsx11(AnimatedHatSprite, { hat: outcome.hat, centerIn: { w: SCENE_W, h: SCENE_H } }) : /* @__PURE__ */ jsx11(HatSprite, { hat: outcome.hat, variant: outcome.variant, centerIn: { w: SCENE_W, h: SCENE_H } });
 }
 
 // src/ui/reveal.ts
@@ -3162,7 +3765,7 @@ async function rollCommand() {
     await runReveal(outcome);
     if (result.result === "hat") {
       const hat = hatById(result.collected.id);
-      const variantSuffix = hat.rarity !== "legendary" && result.collected.variant !== void 0 ? ` #${result.collected.variant + 1}` : "";
+      const variantSuffix = !isAnimatedHat(hat) && result.collected.variant !== void 0 ? ` #${result.collected.variant + 1}` : "";
       console.log(`
 \u2728 ${hat.name}${variantSuffix} [${hat.rarity.toUpperCase()}]
 `);
@@ -3200,8 +3803,9 @@ async function claimCommand(token) {
     console.error("Usage: token-derby claim <token>");
     return 2;
   }
+  let probe;
   try {
-    await probeClaim(token);
+    probe = await probeClaim(token);
   } catch (e) {
     if (e instanceof ApiError) {
       console.error(`Error: ${e.code} ${e.message}`);
@@ -3223,7 +3827,9 @@ async function claimCommand(token) {
     console.error("No horses in your stable. Run `token-derby stable create` first.");
     return 1;
   }
-  console.log("\n\u{1F381} A cosmetic has been awarded to you.\n");
+  console.log(probe.entry_count > 1 ? `
+\u{1F381} A pack of ${probe.entry_count} cosmetics \u2014 one of them will be yours.
+` : "\n\u{1F381} A cosmetic has been awarded to you.\n");
   const picked = await new Promise((resolve) => {
     const app = render7(React15.createElement(HorsePicker, {
       horses: stable.horses,
@@ -3267,7 +3873,7 @@ async function claimCommand(token) {
   await runReveal(outcome);
   if (result.result === "hat") {
     const hat2 = hatById(result.collected.id);
-    const variantSuffix2 = hat2.rarity !== "legendary" && result.collected.variant !== void 0 ? ` #${result.collected.variant + 1}` : "";
+    const variantSuffix2 = !isAnimatedHat(hat2) && result.collected.variant !== void 0 ? ` #${result.collected.variant + 1}` : "";
     console.log(`
 \u2728 ${hat2.name}${variantSuffix2} [${hat2.rarity.toUpperCase()}]
 `);
@@ -3293,12 +3899,9 @@ ${picked.name} already has ${hat?.name ?? result.hat_id}${variantSuffix}. +${res
 
 // src/commands/org-join.ts
 async function orgJoinCommand(token) {
-  if (!token) {
-    console.error("Usage: token-derby organisation join <join-token>");
-    return 2;
-  }
+  const join_token = token?.trim();
   try {
-    const resp = await joinOrganisation({ join_token: token });
+    const resp = await joinOrganisation(join_token ? { join_token } : {});
     console.log(`Joined organisation: ${resp.org_name}`);
     return 0;
   } catch (e) {
@@ -3310,48 +3913,6 @@ async function orgJoinCommand(token) {
   }
 }
 
-// src/commands/web.ts
-import { spawn as spawn2 } from "child_process";
-function webOrigin() {
-  return apiBase().replace(/\/api\/?$/, "");
-}
-function opener() {
-  if (process.platform === "darwin") return "open";
-  if (process.platform === "win32") return "start";
-  if (process.platform === "linux") return "xdg-open";
-  return null;
-}
-async function webCommand(deps = {}) {
-  const spawnImpl = deps.spawnImpl ?? spawn2;
-  let code;
-  try {
-    ({ code } = await createWebSession());
-  } catch (e) {
-    if (e instanceof ApiError) {
-      console.error(`Error: ${e.code} ${e.message}`);
-      return 1;
-    }
-    throw e;
-  }
-  const url = `${webOrigin()}/org-manager#code=${code}`;
-  console.log("");
-  console.log("  Opening the Token Derby org manager in your browser...");
-  console.log(`  ${url}`);
-  console.log("");
-  console.log("  If it doesn't open, copy the link above. It expires in 60 seconds.");
-  const cmd = opener();
-  if (cmd) {
-    try {
-      const child = spawnImpl(cmd, [url], { stdio: "ignore", detached: true });
-      child.on("error", () => {
-      });
-      child.unref();
-    } catch {
-    }
-  }
-  return 0;
-}
-
 // src/commands/env.ts
 function warnOverrides() {
   if (process.env.TOKEN_DERBY_HOME) {
@@ -3386,10 +3947,27 @@ function envCommand(arg) {
 var HELP = `token-derby v${CLI_VERSION}
 
 Identity:
-  token-derby init                        Set up your jockey identity (run this first)
-                                          Re-running renames you on the server.
-  token-derby init --reset                Wipe local identity and create a fresh account.
-                                          Your previous stable is abandoned on the server.
+  token-derby init                        Deprecated \u2014 creates or renames your jockey identity;
+                                          prefer \`login\`, which also links your account.
+  token-derby init --reset                Deprecated \u2014 wipes local identity and starts a fresh
+                                          account (previous stable abandoned); \`login\` recovers
+                                          your existing account instead of abandoning it.
+  token-derby login [--device-name <name>]
+                                          About THIS MACHINE: sign in with Google to give
+                                          it a credential of its own. The way in for a
+                                          machine that has none yet. Adds no email to
+                                          your account \u2014 see \`link\`.
+  token-derby logout                      Retire this machine's credential and clear
+                                          local identity.
+  token-derby link [--device-name <name>]
+                                          About YOUR JOCKEY: connect it to a Google
+                                          account \u2014 adds your email on file, and
+                                          renames your jockey to the first name on
+                                          that account. Then registers this machine
+                                          as a device too, if it is still using the
+                                          shared account credential.
+  token-derby whoami                      Show your jockey name, linked email (if any),
+                                          and this machine's device name (if any).
 
 Maintenance:
   token-derby update                      Check for and install the latest CLI version
@@ -3401,7 +3979,9 @@ Stable management:
   token-derby stable delete <name>        Remove a horse from your stable
 
 Organisations:
-  token-derby organisation join <token>   Join an organisation with a join token
+  token-derby organisation join [token]   Join an organisation with a join token,
+                                          or leave the token out to join by your
+                                          verified email domain
   token-derby web                         Open the web org manager (create orgs,
                                           manage schedules, webhooks, members)
 
@@ -3442,11 +4022,12 @@ async function main() {
     const reset = argv.slice(1).includes("--reset");
     return initCommand(reset);
   }
+  if (cmd === "login") return loginCommand(argv.slice(1));
   if (cmd === "update") return updateCommand();
   if (cmd === "env") return envCommand(argv[1]);
   const identity = await loadIdentity();
   if (!identity) {
-    console.error("Run `token-derby init` to set up your identity before using any other command.");
+    console.error("Run `token-derby login` to set up your identity before using any other command.");
     return 1;
   }
   if (cmd === "stable") {
@@ -3463,13 +4044,16 @@ async function main() {
     const sub = argv[1];
     if (sub === "join") return orgJoinCommand(argv[2]);
     console.error(`Organisation management has moved to the web: token-derby web`);
-    console.error(`The only CLI organisation command is: organisation join <token>`);
+    console.error(`The only CLI organisation command is: organisation join [token]`);
     return 2;
   }
   if (cmd === "create") {
     const orgName = parseFlag(argv.slice(1), "--organisation");
     return createRaceCommand(orgName);
   }
+  if (cmd === "logout") return logoutCommand();
+  if (cmd === "link") return linkCommand(argv.slice(1));
+  if (cmd === "whoami") return whoamiCommand();
   if (cmd === "join") return joinCommand(argv[1], argv.slice(2));
   if (cmd === "end") return endCommand(argv[1]);
   if (cmd === "roll") return rollCommand();