@p4code/cli 0.0.40 → 0.0.41

package/dist/bin.mjs

@@ -7298,9 +7298,16 @@ const TaskToolError = Schema$1.Union([
 */
 const AGENT_ASSET_NAME_MAX_LENGTH = 128;
 const AGENT_ASSET_FILE_PATH_MAX_LENGTH = 256;
-/** Per-file and whole-asset ceilings, enforced at the hub boundary. */
+/**
+* Per-file and whole-asset ceilings, enforced at the hub boundary.
+*
+* The byte total is the meaningful bound — it is what crosses the wire and what
+* a row costs. The file count is a backstop against something pathological, and
+* was initially set low enough to refuse real skills: a documentation-heavy one
+* with a reference directory passes 64 files without being remotely large.
+*/
 const AGENT_ASSET_FILE_MAX_CHARS = 512 * 1024;
-const AGENT_ASSET_TOTAL_MAX_BYTES = 2 * 1024 * 1024;
+const AGENT_ASSET_TOTAL_MAX_BYTES = 4 * 1024 * 1024;
 /**
 * What kind of thing this is.
 *
@@ -7351,7 +7358,7 @@ const AgentAssetFile = Schema$1.Struct({
 	path: AgentAssetFilePath,
 	content: Schema$1.String.check(Schema$1.isMaxLength(AGENT_ASSET_FILE_MAX_CHARS))
 });
-const AgentAssetFiles = Schema$1.Array(AgentAssetFile).check(Schema$1.isMinLength(1), Schema$1.isMaxLength(64));
+const AgentAssetFiles = Schema$1.Array(AgentAssetFile).check(Schema$1.isMinLength(1), Schema$1.isMaxLength(512));
 /**
 * A user-scope asset as the hub holds it.
 *
@@ -7400,6 +7407,20 @@ const AgentAssetListFilter = Schema$1.Struct({ kind: Schema$1.optional(AgentAsse
 * disconnecting.
 */
 const HubSyncMode = Schema$1.Literals(["auto", "paused"]);
+/**
+* Whether new local skills are shared automatically.
+*
+* `all` by default, because the hub exists so that a skill added on one machine
+* does not change agent behaviour there and nowhere else — and a share you have
+* to remember to perform is one that silently stops happening. `selected` is
+* for a machine that holds skills which should stay put.
+*
+* Note what this does not change: nothing is ever taken over. A name the hub
+* already holds from another machine is reported as a collision rather than
+* overwritten, whichever mode is set.
+*/
+const HubShareMode = Schema$1.Literals(["all", "selected"]);
+const HubShareModeInput = Schema$1.Struct({ mode: HubShareMode });
 /** Where a server's hub link came from, so the UI can say why it is read-only. */
 const HubLinkSource = Schema$1.Literals([
 	"environment",
@@ -7440,6 +7461,7 @@ const SkillSyncStatus = Schema$1.Struct({
 	configured: Schema$1.Boolean,
 	hubUrl: Schema$1.NullOr(Schema$1.String),
 	syncMode: HubSyncMode,
+	shareMode: HubShareMode,
 	source: HubLinkSource,
 	skillsRoot: Schema$1.NullOr(Schema$1.String),
 	entries: Schema$1.Array(SkillSyncEntry),
@@ -7749,9 +7771,11 @@ const WS_METHODS = {
 	hubConnect: "hub.connect",
 	hubDisconnect: "hub.disconnect",
 	hubSetSyncMode: "hub.setSyncMode",
+	hubSetShareMode: "hub.setShareMode",
 	hubMintToken: "hub.mintToken",
 	skillsSync: "skills.sync",
 	skillsPublish: "skills.publish",
+	skillsPublishAll: "skills.publishAll",
 	skillsUnpublish: "skills.unpublish",
 	sourceControlLookupRepository: "sourceControl.lookupRepository",
 	sourceControlCloneRepository: "sourceControl.cloneRepository",
@@ -7849,6 +7873,11 @@ const WsHubSetSyncModeRpc = Rpc.make(WS_METHODS.hubSetSyncMode, {
 * has no `crypto.subtle`, and a token generator that silently degrades is not
 * a thing to ship.
 */
+const WsHubSetShareModeRpc = Rpc.make(WS_METHODS.hubSetShareMode, {
+	payload: HubShareModeInput,
+	success: SkillSyncStatus,
+	error: HubRpcError
+});
 const WsHubMintTokenRpc = Rpc.make(WS_METHODS.hubMintToken, {
 	payload: Schema$1.Struct({}),
 	success: HubMintedToken,
@@ -7870,6 +7899,14 @@ const WsSkillsPublishRpc = Rpc.make(WS_METHODS.skillsPublish, {
 	}),
 	error: Schema$1.Union([EnvironmentAuthorizationError])
 });
+const WsSkillsPublishAllRpc = Rpc.make(WS_METHODS.skillsPublishAll, {
+	payload: Schema$1.Struct({}),
+	success: Schema$1.Struct({
+		report: SkillSyncReport,
+		status: SkillSyncStatus
+	}),
+	error: Schema$1.Union([EnvironmentAuthorizationError])
+});
 const WsSkillsUnpublishRpc = Rpc.make(WS_METHODS.skillsUnpublish, {
 	payload: SkillNameInput,
 	success: Schema$1.Struct({
@@ -8246,7 +8283,7 @@ const WsSubscribeAuthAccessRpc = Rpc.make(WS_METHODS.subscribeAuthAccess, {
 	error: Schema$1.Union([AuthAccessStreamError, EnvironmentAuthorizationError]),
 	stream: true
 });
-const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsUnpublishRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
+const WsRpcGroup = RpcGroup.make(WsServerProbeRpc, WsServerGetConfigRpc, WsServerRefreshProvidersRpc, WsServerUpdateProviderRpc, WsServerUpdateServerRpc, WsServerUpsertKeybindingRpc, WsServerRemoveKeybindingRpc, WsServerGetSettingsRpc, WsServerUpdateSettingsRpc, WsServerDiscoverSourceControlRpc, WsServerGetTraceDiagnosticsRpc, WsServerGetProcessDiagnosticsRpc, WsServerGetProcessResourceHistoryRpc, WsServerSignalProcessRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc, WsSourceControlPublishRepositoryRpc, WsProjectsListEntriesRpc, WsProjectsReadFileRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsShellOpenInEditorRpc, WsFilesystemBrowseRpc, WsAssetsCreateUrlRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsVcsListRefsRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsReviewGetDiffPreviewRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsPreviewOpenRpc, WsPreviewNavigateRpc, WsPreviewResizeRpc, WsPreviewRefreshRpc, WsPreviewCloseRpc, WsPreviewListRpc, WsPreviewReportStatusRpc, WsPreviewAutomationConnectRpc, WsPreviewAutomationRespondRpc, WsPreviewAutomationFocusHostRpc, WsSubscribePreviewEventsRpc, WsSubscribeDiscoveredLocalServersRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsTasksListRpc, WsTasksGetRpc, WsTasksCreateRpc, WsTasksUpdateRpc, WsTasksDeleteRpc, WsSubscribeTasksRpc, WsHubGetSyncStatusRpc, WsHubConnectRpc, WsHubDisconnectRpc, WsHubSetSyncModeRpc, WsHubSetShareModeRpc, WsHubMintTokenRpc, WsSkillsSyncRpc, WsSkillsPublishRpc, WsSkillsPublishAllRpc, WsSkillsUnpublishRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
 //#endregion
 //#region ../../packages/shared/src/oauthScope.ts
 const OAUTH_SCOPE_TOKEN = /^[\u0021\u0023-\u005b\u005d-\u007e]+$/u;
@@ -8481,58 +8518,109 @@ Schema$1.TaggedErrorClass()("ProviderSessionRepositoryPersistenceError", {
 	cause: Schema$1.optional(Schema$1.Defect())
 });
 //#endregion
-//#region src/persistence/AuthPairingLinks.ts
-const AuthPairingLinkRecord = Schema$1.Struct({
-	id: Schema$1.String,
-	credential: Schema$1.String,
-	method: Schema$1.Literals(["desktop-bootstrap", "one-time-token"]),
-	scopes: Schema$1.fromJsonString(AuthEnvironmentScopes),
-	subject: Schema$1.String,
+//#region src/persistence/AuthSessions.ts
+const AuthSessionClientMetadataRecord = Schema$1.Struct({
 	label: Schema$1.NullOr(Schema$1.String),
-	proofKeyThumbprint: Schema$1.NullOr(Schema$1.String),
-	createdAt: Schema$1.DateTimeUtcFromString,
+	ipAddress: Schema$1.NullOr(Schema$1.String),
+	userAgent: Schema$1.NullOr(Schema$1.String),
+	deviceType: AuthClientMetadataDeviceType,
+	os: Schema$1.NullOr(Schema$1.String),
+	browser: Schema$1.NullOr(Schema$1.String)
+});
+Schema$1.Struct({
+	sessionId: AuthSessionId,
+	subject: Schema$1.String,
+	scopes: AuthEnvironmentScopes,
+	method: ServerAuthSessionMethod,
+	client: AuthSessionClientMetadataRecord,
+	issuedAt: Schema$1.DateTimeUtcFromString,
 	expiresAt: Schema$1.DateTimeUtcFromString,
-	consumedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString),
+	lastConnectedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString),
 	revokedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString)
 });
-const CreateAuthPairingLinkInput = Schema$1.Struct({
-	id: Schema$1.String,
-	credential: Schema$1.String,
-	method: Schema$1.Literals(["desktop-bootstrap", "one-time-token"]),
-	scopes: AuthEnvironmentScopes,
+const CreateAuthSessionInput = Schema$1.Struct({
+	sessionId: AuthSessionId,
 	subject: Schema$1.String,
-	label: Schema$1.NullOr(Schema$1.String),
-	proofKeyThumbprint: Schema$1.NullOr(Schema$1.String),
-	createdAt: Schema$1.DateTimeUtcFromString,
+	scopes: AuthEnvironmentScopes,
+	method: ServerAuthSessionMethod,
+	client: AuthSessionClientMetadataRecord,
+	issuedAt: Schema$1.DateTimeUtcFromString,
 	expiresAt: Schema$1.DateTimeUtcFromString
 });
-const ConsumeAuthPairingLinkInput = Schema$1.Struct({
-	credential: Schema$1.String,
-	proofKeyThumbprint: Schema$1.NullOr(Schema$1.String),
-	consumedAt: Schema$1.DateTimeUtcFromString,
-	now: Schema$1.DateTimeUtcFromString
+const GetAuthSessionByIdInput = Schema$1.Struct({ sessionId: AuthSessionId });
+const ListActiveAuthSessionsInput = Schema$1.Struct({ now: Schema$1.DateTimeUtcFromString });
+const RevokeAuthSessionInput = Schema$1.Struct({
+	sessionId: AuthSessionId,
+	revokedAt: Schema$1.DateTimeUtcFromString
 });
-const ListActiveAuthPairingLinksInput = Schema$1.Struct({ now: Schema$1.DateTimeUtcFromString });
-const RevokeAuthPairingLinkInput = Schema$1.Struct({
-	id: Schema$1.String,
+const RevokeOtherAuthSessionsInput = Schema$1.Struct({
+	currentSessionId: AuthSessionId,
 	revokedAt: Schema$1.DateTimeUtcFromString
 });
-const GetAuthPairingLinkByCredentialInput = Schema$1.Struct({ credential: Schema$1.String });
-const AuthPairingLinkRawDbRow = Schema$1.Struct({
-	id: Schema$1.String,
-	credential: Schema$1.Unknown,
-	method: Schema$1.Unknown,
-	scopes: Schema$1.Unknown,
+const SetAuthSessionLastConnectedAtInput = Schema$1.Struct({
+	sessionId: AuthSessionId,
+	lastConnectedAt: Schema$1.DateTimeUtcFromString
+});
+var AuthSessionRepository = class extends Context.Service()("@p4code/cli/persistence/AuthSessions/AuthSessionRepository") {};
+const AuthSessionDbRow = Schema$1.Struct({
+	sessionId: AuthSessionId,
+	subject: Schema$1.String,
+	scopes: Schema$1.fromJsonString(AuthEnvironmentScopes),
+	method: ServerAuthSessionMethod,
+	clientLabel: Schema$1.NullOr(Schema$1.String),
+	clientIpAddress: Schema$1.NullOr(Schema$1.String),
+	clientUserAgent: Schema$1.NullOr(Schema$1.String),
+	clientDeviceType: Schema$1.Literals([
+		"desktop",
+		"mobile",
+		"tablet",
+		"bot",
+		"unknown"
+	]),
+	clientOs: Schema$1.NullOr(Schema$1.String),
+	clientBrowser: Schema$1.NullOr(Schema$1.String),
+	issuedAt: Schema$1.DateTimeUtcFromString,
+	expiresAt: Schema$1.DateTimeUtcFromString,
+	lastConnectedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString),
+	revokedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString)
+});
+const AuthSessionRawDbRow = Schema$1.Struct({
+	sessionId: Schema$1.String,
 	subject: Schema$1.Unknown,
-	label: Schema$1.Unknown,
-	proofKeyThumbprint: Schema$1.Unknown,
-	createdAt: Schema$1.Unknown,
+	scopes: Schema$1.Unknown,
+	method: Schema$1.Unknown,
+	clientLabel: Schema$1.Unknown,
+	clientIpAddress: Schema$1.Unknown,
+	clientUserAgent: Schema$1.Unknown,
+	clientDeviceType: Schema$1.Unknown,
+	clientOs: Schema$1.Unknown,
+	clientBrowser: Schema$1.Unknown,
+	issuedAt: Schema$1.Unknown,
 	expiresAt: Schema$1.Unknown,
-	consumedAt: Schema$1.Unknown,
+	lastConnectedAt: Schema$1.Unknown,
 	revokedAt: Schema$1.Unknown
 });
-const decodeAuthPairingLinkDbRow = Schema$1.decodeUnknownEffect(AuthPairingLinkRecord);
-var AuthPairingLinkRepository = class extends Context.Service()("@p4code/cli/persistence/AuthPairingLinks/AuthPairingLinkRepository") {};
+const decodeAuthSessionDbRow = Schema$1.decodeUnknownEffect(AuthSessionDbRow);
+function toAuthSessionRecord(row) {
+	return {
+		sessionId: row.sessionId,
+		subject: row.subject,
+		scopes: row.scopes,
+		method: row.method,
+		client: {
+			label: row.clientLabel,
+			ipAddress: row.clientIpAddress,
+			userAgent: row.clientUserAgent,
+			deviceType: row.clientDeviceType,
+			os: row.clientOs,
+			browser: row.clientBrowser
+		},
+		issuedAt: row.issuedAt,
+		expiresAt: row.expiresAt,
+		lastConnectedAt: row.lastConnectedAt,
+		revokedAt: row.revokedAt
+	};
+}
 function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlation) {
 	return (cause) => Schema$1.isSchemaError(cause) ? PersistenceDecodeError.fromSchemaError(decodeOperation, cause, correlation) : new PersistenceSqlError({
 		operation: sqlOperation,
@@ -8542,674 +8630,881 @@ function toPersistenceSqlOrDecodeError$6(sqlOperation, decodeOperation, correlat
 }
 const make$67 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
-	const createPairingLinkRow = SqlSchema.void({
-		Request: CreateAuthPairingLinkInput,
+	const createSessionRow = SqlSchema.void({
+		Request: CreateAuthSessionInput,
 		execute: (input) => sql`
-        INSERT INTO auth_pairing_links (
-          id,
-          credential,
-          method,
-          scopes,
+        INSERT INTO auth_sessions (
+          session_id,
           subject,
-          label,
-          proof_key_thumbprint,
-          created_at,
+          scopes,
+          method,
+          client_label,
+          client_ip_address,
+          client_user_agent,
+          client_device_type,
+          client_os,
+          client_browser,
+          issued_at,
           expires_at,
-          consumed_at,
           revoked_at
         )
         VALUES (
-          ${input.id},
-          ${input.credential},
-          ${input.method},
-          ${JSON.stringify(input.scopes)},
+          ${input.sessionId},
           ${input.subject},
-          ${input.label},
-          ${input.proofKeyThumbprint},
-          ${input.createdAt},
+          ${JSON.stringify(input.scopes)},
+          ${input.method},
+          ${input.client.label},
+          ${input.client.ipAddress},
+          ${input.client.userAgent},
+          ${input.client.deviceType},
+          ${input.client.os},
+          ${input.client.browser},
+          ${input.issuedAt},
           ${input.expiresAt},
-          NULL,
           NULL
         )
       `
 	});
-	const consumeAvailablePairingLinkRow = SqlSchema.findOneOption({
-		Request: ConsumeAuthPairingLinkInput,
-		Result: AuthPairingLinkRawDbRow,
-		execute: ({ credential, proofKeyThumbprint, consumedAt, now }) => sql`
-        UPDATE auth_pairing_links
-        SET consumed_at = ${consumedAt}
-        WHERE credential = ${credential}
-          AND revoked_at IS NULL
-          AND consumed_at IS NULL
-          AND expires_at > ${now}
-          AND (
-            proof_key_thumbprint IS NULL
-            OR proof_key_thumbprint = ${proofKeyThumbprint}
-          )
-        RETURNING
-          id AS "id",
-          credential AS "credential",
-          method AS "method",
-          scopes AS "scopes",
+	const getSessionRowById = SqlSchema.findOneOption({
+		Request: GetAuthSessionByIdInput,
+		Result: AuthSessionRawDbRow,
+		execute: ({ sessionId }) => sql`
+        SELECT
+          session_id AS "sessionId",
           subject AS "subject",
-          label AS "label",
-          proof_key_thumbprint AS "proofKeyThumbprint",
-          created_at AS "createdAt",
+          scopes AS "scopes",
+          method AS "method",
+          client_label AS "clientLabel",
+          client_ip_address AS "clientIpAddress",
+          client_user_agent AS "clientUserAgent",
+          client_device_type AS "clientDeviceType",
+          client_os AS "clientOs",
+          client_browser AS "clientBrowser",
+          issued_at AS "issuedAt",
           expires_at AS "expiresAt",
-          consumed_at AS "consumedAt",
+          last_connected_at AS "lastConnectedAt",
           revoked_at AS "revokedAt"
+        FROM auth_sessions
+        WHERE session_id = ${sessionId}
       `
 	});
-	const listActivePairingLinkRows = SqlSchema.findAll({
-		Request: ListActiveAuthPairingLinksInput,
-		Result: AuthPairingLinkRawDbRow,
+	const listActiveSessionRows = SqlSchema.findAll({
+		Request: ListActiveAuthSessionsInput,
+		Result: AuthSessionRawDbRow,
 		execute: ({ now }) => sql`
         SELECT
-          id AS "id",
-          credential AS "credential",
-          method AS "method",
-          scopes AS "scopes",
+          session_id AS "sessionId",
           subject AS "subject",
-          label AS "label",
-          proof_key_thumbprint AS "proofKeyThumbprint",
-          created_at AS "createdAt",
+          scopes AS "scopes",
+          method AS "method",
+          client_label AS "clientLabel",
+          client_ip_address AS "clientIpAddress",
+          client_user_agent AS "clientUserAgent",
+          client_device_type AS "clientDeviceType",
+          client_os AS "clientOs",
+          client_browser AS "clientBrowser",
+          issued_at AS "issuedAt",
           expires_at AS "expiresAt",
-          consumed_at AS "consumedAt",
+          last_connected_at AS "lastConnectedAt",
           revoked_at AS "revokedAt"
-        FROM auth_pairing_links
+        FROM auth_sessions
         WHERE revoked_at IS NULL
-          AND consumed_at IS NULL
           AND expires_at > ${now}
-        ORDER BY created_at DESC, id DESC
+        ORDER BY issued_at DESC, session_id DESC
       `
 	});
-	const revokePairingLinkRow = SqlSchema.findAll({
-		Request: RevokeAuthPairingLinkInput,
-		Result: Schema$1.Struct({ id: Schema$1.String }),
-		execute: ({ id, revokedAt }) => sql`
-        UPDATE auth_pairing_links
+	const setLastConnectedAtRow = SqlSchema.void({
+		Request: SetAuthSessionLastConnectedAtInput,
+		execute: ({ sessionId, lastConnectedAt }) => sql`
+        UPDATE auth_sessions
+        SET last_connected_at = ${lastConnectedAt}
+        WHERE session_id = ${sessionId}
+          AND revoked_at IS NULL
+      `
+	});
+	const revokeSessionRows = SqlSchema.findAll({
+		Request: RevokeAuthSessionInput,
+		Result: Schema$1.Struct({ sessionId: AuthSessionId }),
+		execute: ({ sessionId, revokedAt }) => sql`
+        UPDATE auth_sessions
         SET revoked_at = ${revokedAt}
-        WHERE id = ${id}
+        WHERE session_id = ${sessionId}
           AND revoked_at IS NULL
-          AND consumed_at IS NULL
-        RETURNING id AS "id"
+        RETURNING session_id AS "sessionId"
       `
 	});
-	const getPairingLinkRowByCredential = SqlSchema.findOneOption({
-		Request: GetAuthPairingLinkByCredentialInput,
-		Result: AuthPairingLinkRawDbRow,
-		execute: ({ credential }) => sql`
-        SELECT
-          id AS "id",
-          credential AS "credential",
-          method AS "method",
-          scopes AS "scopes",
-          subject AS "subject",
-          label AS "label",
-          proof_key_thumbprint AS "proofKeyThumbprint",
-          created_at AS "createdAt",
-          expires_at AS "expiresAt",
-          consumed_at AS "consumedAt",
-          revoked_at AS "revokedAt"
-        FROM auth_pairing_links
-        WHERE credential = ${credential}
+	const revokeOtherSessionRows = SqlSchema.findAll({
+		Request: RevokeOtherAuthSessionsInput,
+		Result: Schema$1.Struct({ sessionId: AuthSessionId }),
+		execute: ({ currentSessionId, revokedAt }) => sql`
+        UPDATE auth_sessions
+        SET revoked_at = ${revokedAt}
+        WHERE session_id <> ${currentSessionId}
+          AND revoked_at IS NULL
+        RETURNING session_id AS "sessionId"
       `
 	});
-	const create = (input) => createPairingLinkRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthPairingLinkRepository.create:query", "AuthPairingLinkRepository.create:encodeRequest", { pairingLinkId: input.id })));
-	const consumeAvailable = (input) => consumeAvailablePairingLinkRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthPairingLinkRepository.consumeAvailable:query", "AuthPairingLinkRepository.consumeAvailable:decodeRow")), Effect.flatMap((rowOption) => Option.match(rowOption, {
+	const create = (input) => createSessionRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthSessionRepository.create:query", "AuthSessionRepository.create:encodeRequest", { sessionId: input.sessionId })));
+	const getById = (input) => getSessionRowById(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthSessionRepository.getById:query", "AuthSessionRepository.getById:decodeRow", { sessionId: input.sessionId })), Effect.flatMap((rowOption) => Option.match(rowOption, {
 		onNone: () => Effect.succeed(Option.none()),
-		onSome: (row) => decodeAuthPairingLinkDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthPairingLinkRepository.consumeAvailable:decodeRow", cause, { pairingLinkId: row.id })), Effect.map(Option.some))
-	})));
-	const listActive = (input) => listActivePairingLinkRows(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthPairingLinkRepository.listActive:query", "AuthPairingLinkRepository.listActive:decodeRows")), Effect.flatMap((rows) => Effect.forEach(rows, (row) => decodeAuthPairingLinkDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthPairingLinkRepository.listActive:decodeRows", cause, { pairingLinkId: row.id }))))));
-	const revoke = (input) => revokePairingLinkRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthPairingLinkRepository.revoke:query", "AuthPairingLinkRepository.revoke:decodeRows", { pairingLinkId: input.id })), Effect.map((rows) => rows.length > 0));
-	const getByCredential = (input) => getPairingLinkRowByCredential(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthPairingLinkRepository.getByCredential:query", "AuthPairingLinkRepository.getByCredential:decodeRow")), Effect.flatMap((rowOption) => Option.match(rowOption, {
-		onNone: () => Effect.succeed(Option.none()),
-		onSome: (row) => decodeAuthPairingLinkDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthPairingLinkRepository.getByCredential:decodeRow", cause, { pairingLinkId: row.id })), Effect.map(Option.some))
+		onSome: (row) => decodeAuthSessionDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthSessionRepository.getById:decodeRow", cause, { sessionId: input.sessionId })), Effect.map((decodedRow) => Option.some(toAuthSessionRecord(decodedRow))))
 	})));
+	const listActive = (input) => listActiveSessionRows(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthSessionRepository.listActive:query", "AuthSessionRepository.listActive:decodeRows")), Effect.flatMap((rows) => Effect.forEach(rows, (row) => decodeAuthSessionDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthSessionRepository.listActive:decodeRows", cause, { sessionId: row.sessionId })), Effect.map(toAuthSessionRecord)))));
+	const revoke = (input) => revokeSessionRows(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthSessionRepository.revoke:query", "AuthSessionRepository.revoke:decodeRows", { sessionId: input.sessionId })), Effect.map((rows) => rows.length > 0));
+	const revokeAllExcept = (input) => revokeOtherSessionRows(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthSessionRepository.revokeAllExcept:query", "AuthSessionRepository.revokeAllExcept:decodeRows", { currentSessionId: input.currentSessionId })), Effect.map((rows) => rows.map((row) => row.sessionId)));
+	const setLastConnectedAt = (input) => setLastConnectedAtRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$6("AuthSessionRepository.setLastConnectedAt:query", "AuthSessionRepository.setLastConnectedAt:encodeRequest", { sessionId: input.sessionId })));
 	return {
 		create,
-		consumeAvailable,
+		getById,
 		listActive,
 		revoke,
-		getByCredential
+		revokeAllExcept,
+		setLastConnectedAt
 	};
 });
-const layer$63 = Layer.effect(AuthPairingLinkRepository, make$67);
+const layer$63 = Layer.effect(AuthSessionRepository, make$67);
 //#endregion
-//#region src/auth/PairingGrantStore.ts
-var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
+//#region src/auth/ServerSecretStore.ts
+const secretStoreErrorContext = {
+	resource: Schema$1.String,
+	cause: Schema$1.Defect()
+};
+var SecretStoreSecureError = class extends Schema$1.TaggedErrorClass()("SecretStoreSecureError", { ...secretStoreErrorContext }) {
 	get message() {
-		return "Unknown bootstrap credential.";
+		return `Failed to secure ${this.resource}.`;
 	}
 };
-var ExpiredBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("ExpiredBootstrapCredentialError", {}) {
+var SecretStoreReadError = class extends Schema$1.TaggedErrorClass()("SecretStoreReadError", { ...secretStoreErrorContext }) {
 	get message() {
-		return "Bootstrap credential expired.";
+		return `Failed to read ${this.resource}.`;
 	}
 };
-var BootstrapCredentialProofKeyMismatchError = class extends Schema$1.TaggedErrorClass()("BootstrapCredentialProofKeyMismatchError", {}) {
+var SecretStoreTemporaryPathError = class extends Schema$1.TaggedErrorClass()("SecretStoreTemporaryPathError", { ...secretStoreErrorContext }) {
 	get message() {
-		return "Bootstrap credential proof key mismatch.";
+		return `Failed to create temporary path for ${this.resource}.`;
 	}
 };
-var UnavailableBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnavailableBootstrapCredentialError", {}) {
+var SecretStorePersistError = class extends Schema$1.TaggedErrorClass()("SecretStorePersistError", { ...secretStoreErrorContext }) {
 	get message() {
-		return "Bootstrap credential is no longer available.";
+		return `Failed to persist ${this.resource}.`;
 	}
 };
-const BootstrapCredentialInvalidError = Schema$1.Union([
-	UnknownBootstrapCredentialError,
-	ExpiredBootstrapCredentialError,
-	BootstrapCredentialProofKeyMismatchError,
-	UnavailableBootstrapCredentialError
+var SecretStoreRandomGenerationError = class extends Schema$1.TaggedErrorClass()("SecretStoreRandomGenerationError", { ...secretStoreErrorContext }) {
+	get message() {
+		return `Failed to generate random bytes for ${this.resource}.`;
+	}
+};
+var SecretStoreConcurrentReadError = class extends Schema$1.TaggedErrorClass()("SecretStoreConcurrentReadError", { resource: Schema$1.String }) {
+	get message() {
+		return `Failed to read ${this.resource} after concurrent creation.`;
+	}
+};
+var SecretStoreRemoveError = class extends Schema$1.TaggedErrorClass()("SecretStoreRemoveError", { ...secretStoreErrorContext }) {
+	get message() {
+		return `Failed to remove ${this.resource}.`;
+	}
+};
+var SecretStoreDecodeError = class extends Schema$1.TaggedErrorClass()("SecretStoreDecodeError", { ...secretStoreErrorContext }) {
+	get message() {
+		return `Failed to decode ${this.resource}.`;
+	}
+};
+var SecretStoreEncodeError = class extends Schema$1.TaggedErrorClass()("SecretStoreEncodeError", { ...secretStoreErrorContext }) {
+	get message() {
+		return `Failed to encode ${this.resource}.`;
+	}
+};
+const SecretStoreError = Schema$1.Union([
+	SecretStoreSecureError,
+	SecretStoreReadError,
+	SecretStoreTemporaryPathError,
+	SecretStorePersistError,
+	SecretStoreRandomGenerationError,
+	SecretStoreConcurrentReadError,
+	SecretStoreRemoveError,
+	SecretStoreDecodeError,
+	SecretStoreEncodeError
 ]);
-Schema$1.is(BootstrapCredentialInvalidError);
-var ActivePairingLinksLoadError = class extends Schema$1.TaggedErrorClass()("ActivePairingLinksLoadError", { cause: Schema$1.Defect() }) {
+const isSecretStoreError = Schema$1.is(SecretStoreError);
+const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
+const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
+var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
+const make$66 = Effect.gen(function* () {
+	const crypto = yield* Crypto.Crypto;
+	const fileSystem = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const serverConfig = yield* ServerConfig$1;
+	yield* fileSystem.makeDirectory(serverConfig.secretsDir, { recursive: true });
+	yield* fileSystem.chmod(serverConfig.secretsDir, 448).pipe(Effect.mapError((cause) => new SecretStoreSecureError({
+		resource: `secrets directory ${serverConfig.secretsDir}`,
+		cause
+	})));
+	const resolveSecretPath = (name) => path.join(serverConfig.secretsDir, `${name}.bin`);
+	const get = (name) => fileSystem.readFile(resolveSecretPath(name)).pipe(Effect.map((bytes) => Option.some(Uint8Array.from(bytes))), Effect.catch((cause) => cause.reason._tag === "NotFound" ? Effect.succeed(Option.none()) : Effect.fail(new SecretStoreReadError({
+		resource: `secret ${name}`,
+		cause
+	}))), Effect.withSpan("ServerSecretStore.get"));
+	const set = (name, value) => {
+		const secretPath = resolveSecretPath(name);
+		return crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new SecretStoreTemporaryPathError({
+			resource: `secret ${name}`,
+			cause
+		})), Effect.flatMap((uuid) => {
+			const tempPath = `${secretPath}.${uuid}.tmp`;
+			return Effect.gen(function* () {
+				yield* fileSystem.writeFile(tempPath, value);
+				yield* fileSystem.chmod(tempPath, 384);
+				yield* fileSystem.rename(tempPath, secretPath);
+				yield* fileSystem.chmod(secretPath, 384);
+			}).pipe(Effect.catch((cause) => fileSystem.remove(tempPath).pipe(Effect.ignore, Effect.flatMap(() => Effect.fail(new SecretStorePersistError({
+				resource: `secret ${name}`,
+				cause
+			}))))));
+		}), Effect.withSpan("ServerSecretStore.set"));
+	};
+	const create = (name, value) => {
+		const secretPath = resolveSecretPath(name);
+		return Effect.scoped(Effect.gen(function* () {
+			const file = yield* fileSystem.open(secretPath, {
+				flag: "wx",
+				mode: 384
+			});
+			yield* file.writeAll(value);
+			yield* file.sync;
+			yield* fileSystem.chmod(secretPath, 384);
+		})).pipe(Effect.mapError((cause) => new SecretStorePersistError({
+			resource: `secret ${name}`,
+			cause
+		})));
+	};
+	const getOrCreateRandom = (name, bytes) => get(name).pipe(Effect.flatMap(Option.match({
+		onSome: Effect.succeed,
+		onNone: () => crypto.randomBytes(bytes).pipe(Effect.mapError((cause) => new SecretStoreRandomGenerationError({
+			resource: `secret ${name}`,
+			cause
+		})), Effect.flatMap((generated) => create(name, generated).pipe(Effect.as(Uint8Array.from(generated)), Effect.catchIf(isSecretStoreError, (error) => isSecretAlreadyExistsError(error) ? get(name).pipe(Effect.flatMap(Option.match({
+			onSome: Effect.succeed,
+			onNone: () => Effect.fail(new SecretStoreConcurrentReadError({ resource: `secret ${name}` }))
+		}))) : Effect.fail(error)))))
+	})), Effect.withSpan("ServerSecretStore.getOrCreateRandom"));
+	const remove = (name) => fileSystem.remove(resolveSecretPath(name)).pipe(Effect.catch((cause) => cause.reason._tag === "NotFound" ? Effect.void : Effect.fail(new SecretStoreRemoveError({
+		resource: `secret ${name}`,
+		cause
+	}))), Effect.withSpan("ServerSecretStore.remove"));
+	return ServerSecretStore.of({
+		get,
+		set,
+		create,
+		getOrCreateRandom,
+		remove
+	});
+});
+const layer$62 = Layer.effect(ServerSecretStore, make$66);
+//#endregion
+//#region src/auth/SessionStore.ts
+var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
 	get message() {
-		return "Failed to load active pairing links.";
+		return "Malformed session token.";
 	}
 };
-var PairingLinkRevokeError = class extends Schema$1.TaggedErrorClass()("PairingLinkRevokeError", {
-	pairingLinkId: Schema$1.String,
-	cause: Schema$1.Defect()
-}) {
+var InvalidSessionTokenSignatureError = class extends Schema$1.TaggedErrorClass()("InvalidSessionTokenSignatureError", {}) {
 	get message() {
-		return `Failed to revoke pairing link '${this.pairingLinkId}'.`;
+		return "Invalid session token signature.";
 	}
 };
-var PairingCredentialIssueError = class extends Schema$1.TaggedErrorClass()("PairingCredentialIssueError", {
-	pairingLinkId: Schema$1.String,
-	subject: Schema$1.String,
-	label: Schema$1.optional(Schema$1.String),
-	cause: Schema$1.Defect()
+var InvalidSessionTokenPayloadError = class extends Schema$1.TaggedErrorClass()("InvalidSessionTokenPayloadError", { cause: Schema$1.Defect() }) {
+	get message() {
+		return "Invalid session token payload.";
+	}
+};
+var SessionTokenExpiredError = class extends Schema$1.TaggedErrorClass()("SessionTokenExpiredError", {
+	sessionId: AuthSessionId,
+	expiresAt: Schema$1.DateTimeUtc,
+	observedAt: Schema$1.DateTimeUtc
 }) {
 	get message() {
-		return `Failed to issue pairing credential '${this.pairingLinkId}' for '${this.subject}'.`;
+		return "Session token expired.";
 	}
 };
-var PairingCredentialRandomGenerationError = class extends Schema$1.TaggedErrorClass()("PairingCredentialRandomGenerationError", {
-	operation: Schema$1.Literals(["generate-id", "generate-token"]),
-	cause: Schema$1.Defect()
+var UnknownSessionTokenError = class extends Schema$1.TaggedErrorClass()("UnknownSessionTokenError", { sessionId: AuthSessionId }) {
+	get message() {
+		return "Unknown session token.";
+	}
+};
+var SessionTokenRevokedError = class extends Schema$1.TaggedErrorClass()("SessionTokenRevokedError", {
+	sessionId: AuthSessionId,
+	revokedAt: Schema$1.DateTimeUtc
 }) {
 	get message() {
-		return `Failed to generate pairing credential data during '${this.operation}'.`;
+		return "Session token revoked.";
 	}
 };
-var BootstrapCredentialConsumeError = class extends Schema$1.TaggedErrorClass()("BootstrapCredentialConsumeError", { cause: Schema$1.Defect() }) {
+var InvalidSessionExpirationClaimError = class extends Schema$1.TaggedErrorClass()("InvalidSessionExpirationClaimError", {
+	sessionId: AuthSessionId,
+	expirationClaim: Schema$1.Number
+}) {
 	get message() {
-		return "Failed to consume bootstrap credential.";
+		return "Invalid `exp` claim";
 	}
 };
-var BootstrapCredentialConsumeAvailableError = class extends Schema$1.TaggedErrorClass()("BootstrapCredentialConsumeAvailableError", { cause: Schema$1.Defect() }) {
+var MalformedWebSocketTokenError = class extends Schema$1.TaggedErrorClass()("MalformedWebSocketTokenError", {}) {
 	get message() {
-		return "Failed to atomically consume an available bootstrap credential.";
+		return "Malformed websocket token.";
 	}
 };
-var BootstrapCredentialLookupError = class extends Schema$1.TaggedErrorClass()("BootstrapCredentialLookupError", { cause: Schema$1.Defect() }) {
+var InvalidWebSocketTokenSignatureError = class extends Schema$1.TaggedErrorClass()("InvalidWebSocketTokenSignatureError", {}) {
 	get message() {
-		return "Failed to look up bootstrap credential state.";
+		return "Invalid websocket token signature.";
 	}
 };
-const BootstrapCredentialInternalError = Schema$1.Union([
-	ActivePairingLinksLoadError,
-	PairingLinkRevokeError,
-	PairingCredentialIssueError,
-	PairingCredentialRandomGenerationError,
-	BootstrapCredentialConsumeError,
-	BootstrapCredentialConsumeAvailableError,
-	BootstrapCredentialLookupError
-]);
-const isBootstrapCredentialInternalError = Schema$1.is(BootstrapCredentialInternalError);
-const BootstrapCredentialError = Schema$1.Union([BootstrapCredentialInvalidError, BootstrapCredentialInternalError]);
-Schema$1.is(BootstrapCredentialError);
-var PairingGrantStore = class extends Context.Service()("@p4code/cli/auth/PairingGrantStore") {};
-const DEFAULT_ONE_TIME_TOKEN_TTL_MINUTES = Duration.minutes(5);
-const DESKTOP_BOOTSTRAP_TTL_HOURS = Duration.hours(24);
-const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
-const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
-const PAIRING_TOKEN_LENGTH = 12;
-const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
-const make$66 = Effect.gen(function* () {
-	const crypto = yield* Crypto.Crypto;
-	const config = yield* ServerConfig$1;
-	const pairingLinks = yield* AuthPairingLinkRepository;
-	const seededGrantsRef = yield* Ref.make(/* @__PURE__ */ new Map());
-	const changesPubSub = yield* PubSub.unbounded();
-	const generatePairingToken = Effect.gen(function* () {
-		let credential = "";
-		while (credential.length < PAIRING_TOKEN_LENGTH) {
-			const bytes = yield* crypto.randomBytes(PAIRING_TOKEN_LENGTH).pipe(Effect.mapError((cause) => new PairingCredentialRandomGenerationError({
-				operation: "generate-token",
-				cause
-			})));
-			for (const byte of bytes) {
-				if (byte >= PAIRING_TOKEN_REJECTION_LIMIT) continue;
-				credential += PAIRING_TOKEN_ALPHABET[byte % 32];
-				if (credential.length === PAIRING_TOKEN_LENGTH) return credential;
-			}
-		}
-		return credential;
-	});
-	const seedGrant = (credential, grant) => Ref.update(seededGrantsRef, (current) => {
-		const next = new Map(current);
-		next.set(credential, grant);
-		return next;
-	});
-	const emitUpsert = (pairingLink) => PubSub.publish(changesPubSub, {
-		type: "pairingLinkUpserted",
-		pairingLink
-	}).pipe(Effect.asVoid);
-	const emitRemoved = (id) => PubSub.publish(changesPubSub, {
-		type: "pairingLinkRemoved",
-		id
-	}).pipe(Effect.asVoid);
-	if (config.desktopBootstrapToken) {
-		const now = yield* DateTime.now;
-		yield* seedGrant(config.desktopBootstrapToken, {
-			method: "desktop-bootstrap",
-			scopes: AuthAdministrativeScopes,
-			subject: "desktop-bootstrap",
-			expiresAt: DateTime.add(now, { milliseconds: Duration.toMillis(DESKTOP_BOOTSTRAP_TTL_HOURS) }),
-			remainingUses: "unbounded"
-		});
+var InvalidWebSocketTokenPayloadError = class extends Schema$1.TaggedErrorClass()("InvalidWebSocketTokenPayloadError", { cause: Schema$1.Defect() }) {
+	get message() {
+		return "Invalid websocket token payload.";
 	}
-	const listActive = Effect.fn("PairingGrantStore.listActive")(function* () {
-		const now = yield* DateTime.now;
-		return (yield* pairingLinks.listActive({ now })).map((row) => row.label ? {
-			id: row.id,
-			credential: row.credential,
-			scopes: row.scopes,
-			subject: row.subject,
-			label: row.label,
-			createdAt: row.createdAt,
-			expiresAt: row.expiresAt
-		} : {
-			id: row.id,
-			credential: row.credential,
-			scopes: row.scopes,
-			subject: row.subject,
-			createdAt: row.createdAt,
-			expiresAt: row.expiresAt
-		});
-	}, Effect.mapError((cause) => new ActivePairingLinksLoadError({ cause })));
-	const revoke = Effect.fn("PairingGrantStore.revoke")(function* (id) {
-		const revokedAt = yield* DateTime.now;
-		const revoked = yield* pairingLinks.revoke({
-			id,
-			revokedAt
-		}).pipe(Effect.mapError((cause) => new PairingLinkRevokeError({
-			pairingLinkId: id,
-			cause
-		})));
-		if (revoked) yield* emitRemoved(id);
-		return revoked;
-	});
-	const issueOneTimeToken = Effect.fn("PairingGrantStore.issueOneTimeToken")(function* (input) {
-		const id = yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new PairingCredentialRandomGenerationError({
-			operation: "generate-id",
-			cause
-		})));
-		const credential = yield* generatePairingToken;
-		const isDevStartupToken = config.devUrl !== void 0 && input?.purpose === "startup";
-		const ttl = input?.ttl ?? (isDevStartupToken ? DEV_STARTUP_TTL_HOURS : DEFAULT_ONE_TIME_TOKEN_TTL_MINUTES);
-		const now = yield* DateTime.now;
-		const expiresAt = DateTime.add(now, { milliseconds: Duration.toMillis(ttl) });
-		const issued = {
-			id,
-			credential,
-			...input?.label ? { label: input.label } : {},
-			...input?.proofKeyThumbprint ? { proofKeyThumbprint: input.proofKeyThumbprint } : {},
-			expiresAt
-		};
-		const subject = input?.subject ?? "one-time-token";
-		yield* pairingLinks.create({
-			id,
-			credential,
-			method: "one-time-token",
-			scopes: input?.scopes ?? AuthStandardClientScopes,
-			subject,
-			label: input?.label ?? null,
-			proofKeyThumbprint: input?.proofKeyThumbprint ?? null,
-			createdAt: now,
-			expiresAt
-		}).pipe(Effect.mapError((cause) => new PairingCredentialIssueError({
-			pairingLinkId: id,
-			subject,
-			...input?.label ? { label: input.label } : {},
-			cause
-		})));
-		yield* emitUpsert({
-			id,
-			credential,
-			scopes: input?.scopes ?? AuthStandardClientScopes,
-			subject: input?.subject ?? "one-time-token",
-			...input?.label ? { label: input.label } : {},
-			createdAt: now,
-			expiresAt
-		});
-		return issued;
-	});
-	const consume = Effect.fn("PairingGrantStore.consume")(function* (credential, input) {
-		const now = yield* DateTime.now;
-		const seededResult = yield* Ref.modify(seededGrantsRef, (current) => {
-			const grant = current.get(credential);
-			if (!grant) return [{
-				_tag: "error",
-				reason: "not-found",
-				error: new UnknownBootstrapCredentialError({})
-			}, current];
-			const next = new Map(current);
-			if (DateTime.isGreaterThanOrEqualTo(now, grant.expiresAt)) {
-				next.delete(credential);
-				return [{
-					_tag: "error",
-					reason: "expired",
-					error: new ExpiredBootstrapCredentialError({})
-				}, next];
-			}
-			if (grant.proofKeyThumbprint && grant.proofKeyThumbprint !== input?.proofKeyThumbprint) return [{
-				_tag: "error",
-				reason: "not-found",
-				error: new BootstrapCredentialProofKeyMismatchError({})
-			}, next];
-			const remainingUses = grant.remainingUses;
-			if (typeof remainingUses === "number") if (remainingUses <= 1) next.delete(credential);
-			else next.set(credential, {
-				...grant,
-				remainingUses: remainingUses - 1
-			});
-			return [{
-				_tag: "success",
-				grant: {
-					method: grant.method,
-					scopes: grant.scopes,
-					subject: grant.subject,
-					...grant.label ? { label: grant.label } : {},
-					...grant.proofKeyThumbprint ? { proofKeyThumbprint: grant.proofKeyThumbprint } : {},
-					expiresAt: grant.expiresAt
-				}
-			}, next];
-		});
-		if (seededResult._tag === "success") return seededResult.grant;
-		if (seededResult.reason !== "not-found") return yield* seededResult.error;
-		const consumed = yield* pairingLinks.consumeAvailable({
-			credential,
-			proofKeyThumbprint: input?.proofKeyThumbprint ?? null,
-			consumedAt: now,
-			now
-		}).pipe(Effect.mapError((cause) => new BootstrapCredentialConsumeAvailableError({ cause })));
-		if (Option.isSome(consumed)) {
-			yield* emitRemoved(consumed.value.id);
-			return {
-				method: consumed.value.method,
-				scopes: consumed.value.scopes,
-				subject: consumed.value.subject,
-				...consumed.value.label ? { label: consumed.value.label } : {},
-				...consumed.value.proofKeyThumbprint ? { proofKeyThumbprint: consumed.value.proofKeyThumbprint } : {},
-				expiresAt: consumed.value.expiresAt
-			};
-		}
-		const matching = yield* pairingLinks.getByCredential({ credential }).pipe(Effect.mapError((cause) => new BootstrapCredentialLookupError({ cause })));
-		if (Option.isNone(matching)) return yield* new UnknownBootstrapCredentialError({});
-		if (matching.value.revokedAt !== null) return yield* new UnavailableBootstrapCredentialError({});
-		if (matching.value.consumedAt !== null) return yield* new UnknownBootstrapCredentialError({});
-		if (DateTime.isGreaterThanOrEqualTo(now, matching.value.expiresAt)) return yield* new ExpiredBootstrapCredentialError({});
-		if (matching.value.proofKeyThumbprint !== null && matching.value.proofKeyThumbprint !== input?.proofKeyThumbprint) return yield* new BootstrapCredentialProofKeyMismatchError({});
-		return yield* new UnavailableBootstrapCredentialError({});
-	});
-	return PairingGrantStore.of({
-		issueOneTimeToken,
-		listActive,
-		get streamChanges() {
-			return Stream.fromPubSub(changesPubSub);
-		},
-		revoke,
-		consume
-	});
-});
-const layer$62 = Layer.effect(PairingGrantStore, make$66).pipe(Layer.provideMerge(layer$63));
-//#endregion
-//#region src/auth/ServerSecretStore.ts
-const secretStoreErrorContext = {
-	resource: Schema$1.String,
-	cause: Schema$1.Defect()
 };
-var SecretStoreSecureError = class extends Schema$1.TaggedErrorClass()("SecretStoreSecureError", { ...secretStoreErrorContext }) {
+var WebSocketTokenExpiredError = class extends Schema$1.TaggedErrorClass()("WebSocketTokenExpiredError", {
+	sessionId: AuthSessionId,
+	expiresAt: Schema$1.DateTimeUtc,
+	observedAt: Schema$1.DateTimeUtc
+}) {
 	get message() {
-		return `Failed to secure ${this.resource}.`;
+		return "Websocket token expired.";
 	}
 };
-var SecretStoreReadError = class extends Schema$1.TaggedErrorClass()("SecretStoreReadError", { ...secretStoreErrorContext }) {
+var UnknownWebSocketSessionError = class extends Schema$1.TaggedErrorClass()("UnknownWebSocketSessionError", { sessionId: AuthSessionId }) {
 	get message() {
-		return `Failed to read ${this.resource}.`;
+		return "Unknown websocket session.";
 	}
 };
-var SecretStoreTemporaryPathError = class extends Schema$1.TaggedErrorClass()("SecretStoreTemporaryPathError", { ...secretStoreErrorContext }) {
+var WebSocketSessionExpiredError = class extends Schema$1.TaggedErrorClass()("WebSocketSessionExpiredError", {
+	sessionId: AuthSessionId,
+	expiresAt: Schema$1.DateTimeUtc,
+	observedAt: Schema$1.DateTimeUtc
+}) {
 	get message() {
-		return `Failed to create temporary path for ${this.resource}.`;
+		return "Websocket session expired.";
 	}
 };
-var SecretStorePersistError = class extends Schema$1.TaggedErrorClass()("SecretStorePersistError", { ...secretStoreErrorContext }) {
+var WebSocketSessionRevokedError = class extends Schema$1.TaggedErrorClass()("WebSocketSessionRevokedError", {
+	sessionId: AuthSessionId,
+	revokedAt: Schema$1.DateTimeUtc
+}) {
 	get message() {
-		return `Failed to persist ${this.resource}.`;
+		return "Websocket session revoked.";
 	}
 };
-var SecretStoreRandomGenerationError = class extends Schema$1.TaggedErrorClass()("SecretStoreRandomGenerationError", { ...secretStoreErrorContext }) {
+const SessionCredentialInvalidError = Schema$1.Union([
+	MalformedSessionTokenError,
+	InvalidSessionTokenSignatureError,
+	InvalidSessionTokenPayloadError,
+	SessionTokenExpiredError,
+	UnknownSessionTokenError,
+	SessionTokenRevokedError,
+	InvalidSessionExpirationClaimError,
+	MalformedWebSocketTokenError,
+	InvalidWebSocketTokenSignatureError,
+	InvalidWebSocketTokenPayloadError,
+	WebSocketTokenExpiredError,
+	UnknownWebSocketSessionError,
+	WebSocketSessionExpiredError,
+	WebSocketSessionRevokedError
+]);
+const isSessionCredentialInvalidError = Schema$1.is(SessionCredentialInvalidError);
+const sessionCredentialInternalErrorContext = { cause: Schema$1.Defect() };
+var SessionClaimsEncodingError = class extends Schema$1.TaggedErrorClass()("SessionClaimsEncodingError", {
+	sessionId: AuthSessionId,
+	operation: Schema$1.Literals(["encode_session_claims", "encode_websocket_claims"]),
+	...sessionCredentialInternalErrorContext
+}) {
 	get message() {
-		return `Failed to generate random bytes for ${this.resource}.`;
+		return "Failed to encode claims";
 	}
 };
-var SecretStoreConcurrentReadError = class extends Schema$1.TaggedErrorClass()("SecretStoreConcurrentReadError", { resource: Schema$1.String }) {
+var SessionCredentialIssueError = class extends Schema$1.TaggedErrorClass()("SessionCredentialIssueError", {
+	sessionId: Schema$1.optional(AuthSessionId),
+	...sessionCredentialInternalErrorContext
+}) {
 	get message() {
-		return `Failed to read ${this.resource} after concurrent creation.`;
+		return "Failed to issue session credential.";
 	}
 };
-var SecretStoreRemoveError = class extends Schema$1.TaggedErrorClass()("SecretStoreRemoveError", { ...secretStoreErrorContext }) {
+var SessionCredentialVerificationError = class extends Schema$1.TaggedErrorClass()("SessionCredentialVerificationError", {
+	sessionId: AuthSessionId,
+	...sessionCredentialInternalErrorContext
+}) {
 	get message() {
-		return `Failed to remove ${this.resource}.`;
+		return "Failed to verify session credential.";
 	}
 };
-var SecretStoreDecodeError = class extends Schema$1.TaggedErrorClass()("SecretStoreDecodeError", { ...secretStoreErrorContext }) {
+var WebSocketTokenIssueError = class extends Schema$1.TaggedErrorClass()("WebSocketTokenIssueError", {
+	sessionId: AuthSessionId,
+	...sessionCredentialInternalErrorContext
+}) {
 	get message() {
-		return `Failed to decode ${this.resource}.`;
+		return "Failed to issue websocket token.";
 	}
 };
-var SecretStoreEncodeError = class extends Schema$1.TaggedErrorClass()("SecretStoreEncodeError", { ...secretStoreErrorContext }) {
+var WebSocketTokenVerificationError = class extends Schema$1.TaggedErrorClass()("WebSocketTokenVerificationError", {
+	sessionId: AuthSessionId,
+	...sessionCredentialInternalErrorContext
+}) {
 	get message() {
-		return `Failed to encode ${this.resource}.`;
+		return "Failed to verify websocket token.";
 	}
 };
-const SecretStoreError = Schema$1.Union([
-	SecretStoreSecureError,
-	SecretStoreReadError,
-	SecretStoreTemporaryPathError,
-	SecretStorePersistError,
-	SecretStoreRandomGenerationError,
-	SecretStoreConcurrentReadError,
-	SecretStoreRemoveError,
-	SecretStoreDecodeError,
-	SecretStoreEncodeError
+var ActiveSessionsListError = class extends Schema$1.TaggedErrorClass()("ActiveSessionsListError", { ...sessionCredentialInternalErrorContext }) {
+	get message() {
+		return "Failed to list active sessions.";
+	}
+};
+var SessionRevocationError = class extends Schema$1.TaggedErrorClass()("SessionRevocationError", {
+	sessionId: AuthSessionId,
+	...sessionCredentialInternalErrorContext
+}) {
+	get message() {
+		return "Failed to revoke session.";
+	}
+};
+var OtherSessionsRevocationError = class extends Schema$1.TaggedErrorClass()("OtherSessionsRevocationError", {
+	currentSessionId: AuthSessionId,
+	...sessionCredentialInternalErrorContext
+}) {
+	get message() {
+		return "Failed to revoke other sessions.";
+	}
+};
+const SessionCredentialInternalError = Schema$1.Union([
+	SessionClaimsEncodingError,
+	SessionCredentialIssueError,
+	SessionCredentialVerificationError,
+	WebSocketTokenIssueError,
+	WebSocketTokenVerificationError,
+	ActiveSessionsListError,
+	SessionRevocationError,
+	OtherSessionsRevocationError
 ]);
-const isSecretStoreError = Schema$1.is(SecretStoreError);
-const isPlatformError = (value) => Predicate.isTagged(value, "PlatformError");
-const isSecretAlreadyExistsError = (error) => "cause" in error && isPlatformError(error.cause) && error.cause.reason._tag === "AlreadyExists";
-var ServerSecretStore = class extends Context.Service()("@p4code/cli/auth/ServerSecretStore") {};
+Schema$1.is(SessionCredentialInternalError);
+const SessionCredentialError = Schema$1.Union([SessionCredentialInvalidError, SessionCredentialInternalError]);
+Schema$1.is(SessionCredentialError);
+/**
+* Subject the desktop bootstrap grant issues sessions under.
+*
+* Exported so the grant seed and the supersede rule cannot drift: they are the
+* two halves of one decision, and a typo in either would silently turn the
+* cleanup off.
+*/
+const DESKTOP_BOOTSTRAP_SUBJECT = "desktop-bootstrap";
+var SessionStore = class extends Context.Service()("@p4code/cli/auth/SessionStore") {};
+const SIGNING_SECRET_NAME$1 = "server-signing-key";
+const DEFAULT_SESSION_TTL = Duration.days(30);
+const DEFAULT_WEBSOCKET_TOKEN_TTL = Duration.minutes(5);
+const SessionClaims = Schema$1.Struct({
+	v: Schema$1.Literal(1),
+	kind: Schema$1.Literal("session"),
+	sid: AuthSessionId,
+	sub: Schema$1.String,
+	scopes: AuthEnvironmentScopes,
+	method: Schema$1.Literals(["browser-session-cookie", "bearer-access-token"]),
+	jkt: Schema$1.optionalKey(Schema$1.String),
+	iat: Schema$1.Number,
+	exp: Schema$1.Number
+});
+const WebSocketClaims = Schema$1.Struct({
+	v: Schema$1.Literal(1),
+	kind: Schema$1.Literal("websocket"),
+	sid: AuthSessionId,
+	iat: Schema$1.Number,
+	exp: Schema$1.Number
+});
+const decodeSessionClaims = Schema$1.decodeUnknownEffect(Schema$1.fromJsonString(SessionClaims));
+const decodeWebSocketClaims = Schema$1.decodeUnknownEffect(Schema$1.fromJsonString(WebSocketClaims));
+function createDefaultClientMetadata() {
+	return { deviceType: "unknown" };
+}
+function toClientMetadata(record) {
+	return {
+		...record.label ? { label: record.label } : {},
+		...record.ipAddress ? { ipAddress: record.ipAddress } : {},
+		...record.userAgent ? { userAgent: record.userAgent } : {},
+		deviceType: record.deviceType,
+		...record.os ? { os: record.os } : {},
+		...record.browser ? { browser: record.browser } : {}
+	};
+}
+function toAuthClientSession(input) {
+	return {
+		...input,
+		current: false
+	};
+}
 const make$65 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
-	const fileSystem = yield* FileSystem.FileSystem;
-	const path = yield* Path.Path;
 	const serverConfig = yield* ServerConfig$1;
-	yield* fileSystem.makeDirectory(serverConfig.secretsDir, { recursive: true });
-	yield* fileSystem.chmod(serverConfig.secretsDir, 448).pipe(Effect.mapError((cause) => new SecretStoreSecureError({
-		resource: `secrets directory ${serverConfig.secretsDir}`,
+	const secretStore = yield* ServerSecretStore;
+	const authSessions = yield* AuthSessionRepository;
+	const signingSecret = yield* secretStore.getOrCreateRandom(SIGNING_SECRET_NAME$1, 32);
+	const connectedSessionsRef = yield* Ref.make(/* @__PURE__ */ new Map());
+	const changesPubSub = yield* PubSub.unbounded();
+	const cookieName = resolveSessionCookieName({
+		mode: serverConfig.mode,
+		port: serverConfig.port,
+		host: serverConfig.host,
+		instanceKey: serverConfig.stateDir,
+		development: serverConfig.devUrl !== void 0
+	});
+	const emitUpsert = (clientSession) => PubSub.publish(changesPubSub, {
+		type: "clientUpserted",
+		clientSession
+	}).pipe(Effect.asVoid);
+	const emitRemoved = (sessionId) => PubSub.publish(changesPubSub, {
+		type: "clientRemoved",
+		sessionId
+	}).pipe(Effect.asVoid);
+	const loadActiveSession = (sessionId) => Effect.gen(function* () {
+		const row = yield* authSessions.getById({ sessionId });
+		if (Option.isNone(row) || row.value.revokedAt !== null) return Option.none();
+		const connectedSessions = yield* Ref.get(connectedSessionsRef);
+		return Option.some(toAuthClientSession({
+			sessionId: row.value.sessionId,
+			subject: row.value.subject,
+			scopes: row.value.scopes,
+			method: row.value.method,
+			client: toClientMetadata(row.value.client),
+			issuedAt: row.value.issuedAt,
+			expiresAt: row.value.expiresAt,
+			lastConnectedAt: row.value.lastConnectedAt,
+			connected: connectedSessions.has(row.value.sessionId)
+		}));
+	});
+	const markConnected = (sessionId) => Ref.modify(connectedSessionsRef, (current) => {
+		const next = new Map(current);
+		const wasDisconnected = !next.has(sessionId);
+		next.set(sessionId, (next.get(sessionId) ?? 0) + 1);
+		return [wasDisconnected, next];
+	}).pipe(Effect.flatMap((wasDisconnected) => wasDisconnected ? DateTime.now.pipe(Effect.flatMap((lastConnectedAt) => authSessions.setLastConnectedAt({
+		sessionId,
+		lastConnectedAt
+	}))) : Effect.void), Effect.flatMap(() => loadActiveSession(sessionId)), Effect.flatMap((session) => Option.isSome(session) ? emitUpsert(session.value) : Effect.void), Effect.catchCause((cause) => Effect.logError("Failed to publish connected-session auth update.").pipe(Effect.annotateLogs({
+		sessionId,
 		cause
-	})));
-	const resolveSecretPath = (name) => path.join(serverConfig.secretsDir, `${name}.bin`);
-	const get = (name) => fileSystem.readFile(resolveSecretPath(name)).pipe(Effect.map((bytes) => Option.some(Uint8Array.from(bytes))), Effect.catch((cause) => cause.reason._tag === "NotFound" ? Effect.succeed(Option.none()) : Effect.fail(new SecretStoreReadError({
-		resource: `secret ${name}`,
+	}))), Effect.withSpan("SessionStore.markConnected"));
+	const markDisconnected = (sessionId) => Ref.update(connectedSessionsRef, (current) => {
+		const next = new Map(current);
+		const remaining = (next.get(sessionId) ?? 0) - 1;
+		if (remaining > 0) next.set(sessionId, remaining);
+		else next.delete(sessionId);
+		return next;
+	}).pipe(Effect.flatMap(() => loadActiveSession(sessionId)), Effect.flatMap((session) => Option.isSome(session) ? emitUpsert(session.value) : Effect.void), Effect.catchCause((cause) => Effect.logError("Failed to publish disconnected-session auth update.").pipe(Effect.annotateLogs({
+		sessionId,
 		cause
-	}))), Effect.withSpan("ServerSecretStore.get"));
-	const set = (name, value) => {
-		const secretPath = resolveSecretPath(name);
-		return crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new SecretStoreTemporaryPathError({
-			resource: `secret ${name}`,
+	}))), Effect.withSpan("SessionStore.markDisconnected"));
+	const encodeClaims = Schema$1.encodeEffect(Schema$1.fromJsonString(SessionClaims));
+	/**
+	* Revokes every other live session belonging to the same subject.
+	*
+	* Best effort: a session that could not be retired is a stale row in a list,
+	* which is untidy, and failing the issue over it would mean a desktop app
+	* that cannot start. The next launch tries again.
+	*/
+	const supersedePriorSessions = Effect.fn("SessionStore.supersedePriorSessions")(function* (keep, subject) {
+		const active = yield* listActive().pipe(Effect.orElseSucceed(() => []));
+		for (const session of active) {
+			if (session.sessionId === keep || session.subject !== subject) continue;
+			yield* revoke(session.sessionId).pipe(Effect.ignore);
+		}
+	});
+	const issue = Effect.fn("SessionStore.issue")(function* (input) {
+		const sessionId = AuthSessionId.make(yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new SessionCredentialIssueError({ cause }))));
+		const issuedAt = yield* DateTime.now;
+		const expiresAt = DateTime.add(issuedAt, { milliseconds: Duration.toMillis(input?.ttl ?? DEFAULT_SESSION_TTL) });
+		const claims = {
+			v: 1,
+			kind: "session",
+			sid: sessionId,
+			sub: input?.subject ?? "browser",
+			scopes: input?.scopes ?? AuthStandardClientScopes,
+			method: input?.method ?? "browser-session-cookie",
+			...input?.proofKeyThumbprint ? { jkt: input.proofKeyThumbprint } : {},
+			iat: issuedAt.epochMilliseconds,
+			exp: expiresAt.epochMilliseconds
+		};
+		const encodedPayload = yield* encodeClaims(claims).pipe(Effect.map(base64UrlEncode), Effect.mapError((cause) => new SessionCredentialIssueError({
+			sessionId,
+			cause: new SessionClaimsEncodingError({
+				sessionId,
+				operation: "encode_session_claims",
+				cause
+			})
+		})));
+		const signature = signPayload(encodedPayload, signingSecret);
+		const client = input?.client ?? createDefaultClientMetadata();
+		yield* authSessions.create({
+			sessionId,
+			subject: claims.sub,
+			scopes: claims.scopes,
+			method: claims.method,
+			client: {
+				label: client.label ?? null,
+				ipAddress: client.ipAddress ?? null,
+				userAgent: client.userAgent ?? null,
+				deviceType: client.deviceType,
+				os: client.os ?? null,
+				browser: client.browser ?? null
+			},
+			issuedAt,
+			expiresAt
+		}).pipe(Effect.mapError((cause) => new SessionCredentialIssueError({
+			sessionId,
 			cause
-		})), Effect.flatMap((uuid) => {
-			const tempPath = `${secretPath}.${uuid}.tmp`;
-			return Effect.gen(function* () {
-				yield* fileSystem.writeFile(tempPath, value);
-				yield* fileSystem.chmod(tempPath, 384);
-				yield* fileSystem.rename(tempPath, secretPath);
-				yield* fileSystem.chmod(secretPath, 384);
-			}).pipe(Effect.catch((cause) => fileSystem.remove(tempPath).pipe(Effect.ignore, Effect.flatMap(() => Effect.fail(new SecretStorePersistError({
-				resource: `secret ${name}`,
+		})));
+		yield* emitUpsert(toAuthClientSession({
+			sessionId,
+			subject: claims.sub,
+			scopes: claims.scopes,
+			method: claims.method,
+			client,
+			issuedAt,
+			expiresAt,
+			lastConnectedAt: null,
+			connected: false
+		}));
+		if (claims.sub === "desktop-bootstrap") yield* supersedePriorSessions(sessionId, claims.sub);
+		return {
+			sessionId,
+			token: `${encodedPayload}.${signature}`,
+			method: claims.method,
+			client,
+			expiresAt,
+			scopes: claims.scopes,
+			...claims.jkt ? { proofKeyThumbprint: claims.jkt } : {}
+		};
+	});
+	const verify = Effect.fn("SessionStore.verify")(function* (token) {
+		const [encodedPayload, signature] = token.split(".");
+		if (!encodedPayload || !signature) return yield* new MalformedSessionTokenError({});
+		if (!timingSafeEqualBase64Url(signature, signPayload(encodedPayload, signingSecret))) return yield* new InvalidSessionTokenSignatureError({});
+		const claims = yield* decodeSessionClaims(base64UrlDecodeUtf8(encodedPayload)).pipe(Effect.mapError((cause) => new InvalidSessionTokenPayloadError({ cause })));
+		const observedAt = yield* DateTime.now;
+		const expiresAt = DateTime.make(claims.exp);
+		if (Option.isNone(expiresAt)) return yield* new InvalidSessionExpirationClaimError({
+			sessionId: claims.sid,
+			expirationClaim: claims.exp
+		});
+		if (claims.exp <= observedAt.epochMilliseconds) return yield* new SessionTokenExpiredError({
+			sessionId: claims.sid,
+			expiresAt: expiresAt.value,
+			observedAt
+		});
+		const row = yield* authSessions.getById({ sessionId: claims.sid }).pipe(Effect.mapError((cause) => new SessionCredentialVerificationError({
+			sessionId: claims.sid,
+			cause
+		})));
+		if (Option.isNone(row)) return yield* new UnknownSessionTokenError({ sessionId: claims.sid });
+		if (row.value.revokedAt !== null) return yield* new SessionTokenRevokedError({
+			sessionId: claims.sid,
+			revokedAt: row.value.revokedAt
+		});
+		return {
+			sessionId: claims.sid,
+			token,
+			method: claims.method,
+			client: toClientMetadata(row.value.client),
+			expiresAt: expiresAt.value,
+			subject: claims.sub,
+			scopes: claims.scopes,
+			...claims.jkt ? { proofKeyThumbprint: claims.jkt } : {}
+		};
+	});
+	const encodeWsClaims = Schema$1.encodeEffect(Schema$1.fromJsonString(WebSocketClaims));
+	const issueWebSocketToken = Effect.fn("SessionStore.issueWebSocketToken")(function* (sessionId, input) {
+		const issuedAt = yield* DateTime.now;
+		const expiresAt = DateTime.add(issuedAt, { milliseconds: Duration.toMillis(input?.ttl ?? DEFAULT_WEBSOCKET_TOKEN_TTL) });
+		const claims = {
+			v: 1,
+			kind: "websocket",
+			sid: sessionId,
+			iat: issuedAt.epochMilliseconds,
+			exp: expiresAt.epochMilliseconds
+		};
+		const encodedPayload = yield* encodeWsClaims(claims).pipe(Effect.map(base64UrlEncode), Effect.mapError((cause) => new WebSocketTokenIssueError({
+			sessionId,
+			cause: new SessionClaimsEncodingError({
+				sessionId,
+				operation: "encode_websocket_claims",
 				cause
-			}))))));
-		}), Effect.withSpan("ServerSecretStore.set"));
-	};
-	const create = (name, value) => {
-		const secretPath = resolveSecretPath(name);
-		return Effect.scoped(Effect.gen(function* () {
-			const file = yield* fileSystem.open(secretPath, {
-				flag: "wx",
-				mode: 384
-			});
-			yield* file.writeAll(value);
-			yield* file.sync;
-			yield* fileSystem.chmod(secretPath, 384);
-		})).pipe(Effect.mapError((cause) => new SecretStorePersistError({
-			resource: `secret ${name}`,
+			})
+		})));
+		return {
+			token: `${encodedPayload}.${signPayload(encodedPayload, signingSecret)}`,
+			expiresAt
+		};
+	});
+	const verifyWebSocketToken = Effect.fn("SessionStore.verifyWebSocketToken")(function* (token) {
+		const [encodedPayload, signature] = token.split(".");
+		if (!encodedPayload || !signature) return yield* new MalformedWebSocketTokenError({});
+		if (!timingSafeEqualBase64Url(signature, signPayload(encodedPayload, signingSecret))) return yield* new InvalidWebSocketTokenSignatureError({});
+		const claims = yield* decodeWebSocketClaims(base64UrlDecodeUtf8(encodedPayload)).pipe(Effect.mapError((cause) => new InvalidWebSocketTokenPayloadError({ cause })));
+		const observedAt = yield* DateTime.now;
+		const expiresAt = DateTime.make(claims.exp);
+		if (Option.isNone(expiresAt)) return yield* new InvalidSessionExpirationClaimError({
+			sessionId: claims.sid,
+			expirationClaim: claims.exp
+		});
+		if (claims.exp <= observedAt.epochMilliseconds) return yield* new WebSocketTokenExpiredError({
+			sessionId: claims.sid,
+			expiresAt: expiresAt.value,
+			observedAt
+		});
+		const row = yield* authSessions.getById({ sessionId: claims.sid }).pipe(Effect.mapError((cause) => new WebSocketTokenVerificationError({
+			sessionId: claims.sid,
 			cause
 		})));
-	};
-	const getOrCreateRandom = (name, bytes) => get(name).pipe(Effect.flatMap(Option.match({
-		onSome: Effect.succeed,
-		onNone: () => crypto.randomBytes(bytes).pipe(Effect.mapError((cause) => new SecretStoreRandomGenerationError({
-			resource: `secret ${name}`,
+		if (Option.isNone(row)) return yield* new UnknownWebSocketSessionError({ sessionId: claims.sid });
+		if (row.value.expiresAt.epochMilliseconds <= observedAt.epochMilliseconds) return yield* new WebSocketSessionExpiredError({
+			sessionId: claims.sid,
+			expiresAt: row.value.expiresAt,
+			observedAt
+		});
+		if (row.value.revokedAt !== null) return yield* new WebSocketSessionRevokedError({
+			sessionId: claims.sid,
+			revokedAt: row.value.revokedAt
+		});
+		return {
+			sessionId: row.value.sessionId,
+			token,
+			method: row.value.method,
+			client: toClientMetadata(row.value.client),
+			expiresAt: row.value.expiresAt,
+			subject: row.value.subject,
+			scopes: row.value.scopes
+		};
+	});
+	const listActive = Effect.fn("SessionStore.listActive")(function* () {
+		const now = yield* DateTime.now;
+		const connectedSessions = yield* Ref.get(connectedSessionsRef);
+		return (yield* authSessions.listActive({ now })).map((row) => toAuthClientSession({
+			sessionId: row.sessionId,
+			subject: row.subject,
+			scopes: row.scopes,
+			method: row.method,
+			client: toClientMetadata(row.client),
+			issuedAt: row.issuedAt,
+			expiresAt: row.expiresAt,
+			lastConnectedAt: row.lastConnectedAt,
+			connected: connectedSessions.has(row.sessionId)
+		}));
+	}, Effect.mapError((cause) => new ActiveSessionsListError({ cause })));
+	const revoke = Effect.fn("SessionStore.revoke")(function* (sessionId) {
+		const revokedAt = yield* DateTime.now;
+		const revoked = yield* authSessions.revoke({
+			sessionId,
+			revokedAt
+		}).pipe(Effect.mapError((cause) => new SessionRevocationError({
+			sessionId,
 			cause
-		})), Effect.flatMap((generated) => create(name, generated).pipe(Effect.as(Uint8Array.from(generated)), Effect.catchIf(isSecretStoreError, (error) => isSecretAlreadyExistsError(error) ? get(name).pipe(Effect.flatMap(Option.match({
-			onSome: Effect.succeed,
-			onNone: () => Effect.fail(new SecretStoreConcurrentReadError({ resource: `secret ${name}` }))
-		}))) : Effect.fail(error)))))
-	})), Effect.withSpan("ServerSecretStore.getOrCreateRandom"));
-	const remove = (name) => fileSystem.remove(resolveSecretPath(name)).pipe(Effect.catch((cause) => cause.reason._tag === "NotFound" ? Effect.void : Effect.fail(new SecretStoreRemoveError({
-		resource: `secret ${name}`,
-		cause
-	}))), Effect.withSpan("ServerSecretStore.remove"));
-	return ServerSecretStore.of({
-		get,
-		set,
-		create,
-		getOrCreateRandom,
-		remove
+		})));
+		if (revoked) {
+			yield* Ref.update(connectedSessionsRef, (current) => {
+				const next = new Map(current);
+				next.delete(sessionId);
+				return next;
+			});
+			yield* emitRemoved(sessionId);
+		}
+		return revoked;
+	});
+	const revokeAllExcept = Effect.fn("SessionStore.revokeAllExcept")(function* (sessionId) {
+		const revokedAt = yield* DateTime.now;
+		const revokedSessionIds = yield* authSessions.revokeAllExcept({
+			currentSessionId: sessionId,
+			revokedAt
+		}).pipe(Effect.mapError((cause) => new OtherSessionsRevocationError({
+			currentSessionId: sessionId,
+			cause
+		})));
+		if (revokedSessionIds.length > 0) {
+			yield* Ref.update(connectedSessionsRef, (current) => {
+				const next = new Map(current);
+				for (const revokedSessionId of revokedSessionIds) next.delete(revokedSessionId);
+				return next;
+			});
+			yield* Effect.forEach(revokedSessionIds, (revokedSessionId) => emitRemoved(revokedSessionId), {
+				concurrency: "unbounded",
+				discard: true
+			});
+		}
+		return revokedSessionIds.length;
+	});
+	return SessionStore.of({
+		cookieName,
+		issue,
+		verify,
+		issueWebSocketToken,
+		verifyWebSocketToken,
+		listActive,
+		get streamChanges() {
+			return Stream.fromPubSub(changesPubSub);
+		},
+		revoke,
+		revokeAllExcept,
+		markConnected,
+		markDisconnected
 	});
 });
-const layer$61 = Layer.effect(ServerSecretStore, make$65);
+const layer$61 = Layer.effect(SessionStore, make$65).pipe(Layer.provideMerge(layer$63));
 //#endregion
-//#region src/persistence/AuthSessions.ts
-const AuthSessionClientMetadataRecord = Schema$1.Struct({
-	label: Schema$1.NullOr(Schema$1.String),
-	ipAddress: Schema$1.NullOr(Schema$1.String),
-	userAgent: Schema$1.NullOr(Schema$1.String),
-	deviceType: AuthClientMetadataDeviceType,
-	os: Schema$1.NullOr(Schema$1.String),
-	browser: Schema$1.NullOr(Schema$1.String)
-});
-Schema$1.Struct({
-	sessionId: AuthSessionId,
-	subject: Schema$1.String,
-	scopes: AuthEnvironmentScopes,
-	method: ServerAuthSessionMethod,
-	client: AuthSessionClientMetadataRecord,
-	issuedAt: Schema$1.DateTimeUtcFromString,
+//#region src/persistence/AuthPairingLinks.ts
+const AuthPairingLinkRecord = Schema$1.Struct({
+	id: Schema$1.String,
+	credential: Schema$1.String,
+	method: Schema$1.Literals(["desktop-bootstrap", "one-time-token"]),
+	scopes: Schema$1.fromJsonString(AuthEnvironmentScopes),
+	subject: Schema$1.String,
+	label: Schema$1.NullOr(Schema$1.String),
+	proofKeyThumbprint: Schema$1.NullOr(Schema$1.String),
+	createdAt: Schema$1.DateTimeUtcFromString,
 	expiresAt: Schema$1.DateTimeUtcFromString,
-	lastConnectedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString),
+	consumedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString),
 	revokedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString)
 });
-const CreateAuthSessionInput = Schema$1.Struct({
-	sessionId: AuthSessionId,
-	subject: Schema$1.String,
+const CreateAuthPairingLinkInput = Schema$1.Struct({
+	id: Schema$1.String,
+	credential: Schema$1.String,
+	method: Schema$1.Literals(["desktop-bootstrap", "one-time-token"]),
 	scopes: AuthEnvironmentScopes,
-	method: ServerAuthSessionMethod,
-	client: AuthSessionClientMetadataRecord,
-	issuedAt: Schema$1.DateTimeUtcFromString,
+	subject: Schema$1.String,
+	label: Schema$1.NullOr(Schema$1.String),
+	proofKeyThumbprint: Schema$1.NullOr(Schema$1.String),
+	createdAt: Schema$1.DateTimeUtcFromString,
 	expiresAt: Schema$1.DateTimeUtcFromString
 });
-const GetAuthSessionByIdInput = Schema$1.Struct({ sessionId: AuthSessionId });
-const ListActiveAuthSessionsInput = Schema$1.Struct({ now: Schema$1.DateTimeUtcFromString });
-const RevokeAuthSessionInput = Schema$1.Struct({
-	sessionId: AuthSessionId,
-	revokedAt: Schema$1.DateTimeUtcFromString
+const ConsumeAuthPairingLinkInput = Schema$1.Struct({
+	credential: Schema$1.String,
+	proofKeyThumbprint: Schema$1.NullOr(Schema$1.String),
+	consumedAt: Schema$1.DateTimeUtcFromString,
+	now: Schema$1.DateTimeUtcFromString
 });
-const RevokeOtherAuthSessionsInput = Schema$1.Struct({
-	currentSessionId: AuthSessionId,
+const ListActiveAuthPairingLinksInput = Schema$1.Struct({ now: Schema$1.DateTimeUtcFromString });
+const RevokeAuthPairingLinkInput = Schema$1.Struct({
+	id: Schema$1.String,
 	revokedAt: Schema$1.DateTimeUtcFromString
 });
-const SetAuthSessionLastConnectedAtInput = Schema$1.Struct({
-	sessionId: AuthSessionId,
-	lastConnectedAt: Schema$1.DateTimeUtcFromString
-});
-var AuthSessionRepository = class extends Context.Service()("@p4code/cli/persistence/AuthSessions/AuthSessionRepository") {};
-const AuthSessionDbRow = Schema$1.Struct({
-	sessionId: AuthSessionId,
-	subject: Schema$1.String,
-	scopes: Schema$1.fromJsonString(AuthEnvironmentScopes),
-	method: ServerAuthSessionMethod,
-	clientLabel: Schema$1.NullOr(Schema$1.String),
-	clientIpAddress: Schema$1.NullOr(Schema$1.String),
-	clientUserAgent: Schema$1.NullOr(Schema$1.String),
-	clientDeviceType: Schema$1.Literals([
-		"desktop",
-		"mobile",
-		"tablet",
-		"bot",
-		"unknown"
-	]),
-	clientOs: Schema$1.NullOr(Schema$1.String),
-	clientBrowser: Schema$1.NullOr(Schema$1.String),
-	issuedAt: Schema$1.DateTimeUtcFromString,
-	expiresAt: Schema$1.DateTimeUtcFromString,
-	lastConnectedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString),
-	revokedAt: Schema$1.NullOr(Schema$1.DateTimeUtcFromString)
-});
-const AuthSessionRawDbRow = Schema$1.Struct({
-	sessionId: Schema$1.String,
-	subject: Schema$1.Unknown,
-	scopes: Schema$1.Unknown,
+const GetAuthPairingLinkByCredentialInput = Schema$1.Struct({ credential: Schema$1.String });
+const AuthPairingLinkRawDbRow = Schema$1.Struct({
+	id: Schema$1.String,
+	credential: Schema$1.Unknown,
 	method: Schema$1.Unknown,
-	clientLabel: Schema$1.Unknown,
-	clientIpAddress: Schema$1.Unknown,
-	clientUserAgent: Schema$1.Unknown,
-	clientDeviceType: Schema$1.Unknown,
-	clientOs: Schema$1.Unknown,
-	clientBrowser: Schema$1.Unknown,
-	issuedAt: Schema$1.Unknown,
+	scopes: Schema$1.Unknown,
+	subject: Schema$1.Unknown,
+	label: Schema$1.Unknown,
+	proofKeyThumbprint: Schema$1.Unknown,
+	createdAt: Schema$1.Unknown,
 	expiresAt: Schema$1.Unknown,
-	lastConnectedAt: Schema$1.Unknown,
+	consumedAt: Schema$1.Unknown,
 	revokedAt: Schema$1.Unknown
 });
-const decodeAuthSessionDbRow = Schema$1.decodeUnknownEffect(AuthSessionDbRow);
-function toAuthSessionRecord(row) {
-	return {
-		sessionId: row.sessionId,
-		subject: row.subject,
-		scopes: row.scopes,
-		method: row.method,
-		client: {
-			label: row.clientLabel,
-			ipAddress: row.clientIpAddress,
-			userAgent: row.clientUserAgent,
-			deviceType: row.clientDeviceType,
-			os: row.clientOs,
-			browser: row.clientBrowser
-		},
-		issuedAt: row.issuedAt,
-		expiresAt: row.expiresAt,
-		lastConnectedAt: row.lastConnectedAt,
-		revokedAt: row.revokedAt
-	};
-}
+const decodeAuthPairingLinkDbRow = Schema$1.decodeUnknownEffect(AuthPairingLinkRecord);
+var AuthPairingLinkRepository = class extends Context.Service()("@p4code/cli/persistence/AuthPairingLinks/AuthPairingLinkRepository") {};
 function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlation) {
 	return (cause) => Schema$1.isSchemaError(cause) ? PersistenceDecodeError.fromSchemaError(decodeOperation, cause, correlation) : new PersistenceSqlError({
 		operation: sqlOperation,
@@ -9219,668 +9514,433 @@ function toPersistenceSqlOrDecodeError$5(sqlOperation, decodeOperation, correlat
 }
 const make$64 = Effect.gen(function* () {
 	const sql = yield* SqlClient.SqlClient;
-	const createSessionRow = SqlSchema.void({
-		Request: CreateAuthSessionInput,
+	const createPairingLinkRow = SqlSchema.void({
+		Request: CreateAuthPairingLinkInput,
 		execute: (input) => sql`
-        INSERT INTO auth_sessions (
-          session_id,
-          subject,
-          scopes,
+        INSERT INTO auth_pairing_links (
+          id,
+          credential,
           method,
-          client_label,
-          client_ip_address,
-          client_user_agent,
-          client_device_type,
-          client_os,
-          client_browser,
-          issued_at,
+          scopes,
+          subject,
+          label,
+          proof_key_thumbprint,
+          created_at,
           expires_at,
+          consumed_at,
           revoked_at
         )
         VALUES (
-          ${input.sessionId},
-          ${input.subject},
-          ${JSON.stringify(input.scopes)},
+          ${input.id},
+          ${input.credential},
           ${input.method},
-          ${input.client.label},
-          ${input.client.ipAddress},
-          ${input.client.userAgent},
-          ${input.client.deviceType},
-          ${input.client.os},
-          ${input.client.browser},
-          ${input.issuedAt},
+          ${JSON.stringify(input.scopes)},
+          ${input.subject},
+          ${input.label},
+          ${input.proofKeyThumbprint},
+          ${input.createdAt},
           ${input.expiresAt},
+          NULL,
           NULL
         )
       `
 	});
-	const getSessionRowById = SqlSchema.findOneOption({
-		Request: GetAuthSessionByIdInput,
-		Result: AuthSessionRawDbRow,
-		execute: ({ sessionId }) => sql`
-        SELECT
-          session_id AS "sessionId",
-          subject AS "subject",
-          scopes AS "scopes",
+	const consumeAvailablePairingLinkRow = SqlSchema.findOneOption({
+		Request: ConsumeAuthPairingLinkInput,
+		Result: AuthPairingLinkRawDbRow,
+		execute: ({ credential, proofKeyThumbprint, consumedAt, now }) => sql`
+        UPDATE auth_pairing_links
+        SET consumed_at = ${consumedAt}
+        WHERE credential = ${credential}
+          AND revoked_at IS NULL
+          AND consumed_at IS NULL
+          AND expires_at > ${now}
+          AND (
+            proof_key_thumbprint IS NULL
+            OR proof_key_thumbprint = ${proofKeyThumbprint}
+          )
+        RETURNING
+          id AS "id",
+          credential AS "credential",
           method AS "method",
-          client_label AS "clientLabel",
-          client_ip_address AS "clientIpAddress",
-          client_user_agent AS "clientUserAgent",
-          client_device_type AS "clientDeviceType",
-          client_os AS "clientOs",
-          client_browser AS "clientBrowser",
-          issued_at AS "issuedAt",
+          scopes AS "scopes",
+          subject AS "subject",
+          label AS "label",
+          proof_key_thumbprint AS "proofKeyThumbprint",
+          created_at AS "createdAt",
           expires_at AS "expiresAt",
-          last_connected_at AS "lastConnectedAt",
+          consumed_at AS "consumedAt",
           revoked_at AS "revokedAt"
-        FROM auth_sessions
-        WHERE session_id = ${sessionId}
       `
 	});
-	const listActiveSessionRows = SqlSchema.findAll({
-		Request: ListActiveAuthSessionsInput,
-		Result: AuthSessionRawDbRow,
+	const listActivePairingLinkRows = SqlSchema.findAll({
+		Request: ListActiveAuthPairingLinksInput,
+		Result: AuthPairingLinkRawDbRow,
 		execute: ({ now }) => sql`
         SELECT
-          session_id AS "sessionId",
-          subject AS "subject",
-          scopes AS "scopes",
+          id AS "id",
+          credential AS "credential",
           method AS "method",
-          client_label AS "clientLabel",
-          client_ip_address AS "clientIpAddress",
-          client_user_agent AS "clientUserAgent",
-          client_device_type AS "clientDeviceType",
-          client_os AS "clientOs",
-          client_browser AS "clientBrowser",
-          issued_at AS "issuedAt",
+          scopes AS "scopes",
+          subject AS "subject",
+          label AS "label",
+          proof_key_thumbprint AS "proofKeyThumbprint",
+          created_at AS "createdAt",
           expires_at AS "expiresAt",
-          last_connected_at AS "lastConnectedAt",
+          consumed_at AS "consumedAt",
           revoked_at AS "revokedAt"
-        FROM auth_sessions
+        FROM auth_pairing_links
         WHERE revoked_at IS NULL
+          AND consumed_at IS NULL
           AND expires_at > ${now}
-        ORDER BY issued_at DESC, session_id DESC
-      `
-	});
-	const setLastConnectedAtRow = SqlSchema.void({
-		Request: SetAuthSessionLastConnectedAtInput,
-		execute: ({ sessionId, lastConnectedAt }) => sql`
-        UPDATE auth_sessions
-        SET last_connected_at = ${lastConnectedAt}
-        WHERE session_id = ${sessionId}
-          AND revoked_at IS NULL
+        ORDER BY created_at DESC, id DESC
       `
 	});
-	const revokeSessionRows = SqlSchema.findAll({
-		Request: RevokeAuthSessionInput,
-		Result: Schema$1.Struct({ sessionId: AuthSessionId }),
-		execute: ({ sessionId, revokedAt }) => sql`
-        UPDATE auth_sessions
+	const revokePairingLinkRow = SqlSchema.findAll({
+		Request: RevokeAuthPairingLinkInput,
+		Result: Schema$1.Struct({ id: Schema$1.String }),
+		execute: ({ id, revokedAt }) => sql`
+        UPDATE auth_pairing_links
         SET revoked_at = ${revokedAt}
-        WHERE session_id = ${sessionId}
+        WHERE id = ${id}
           AND revoked_at IS NULL
-        RETURNING session_id AS "sessionId"
+          AND consumed_at IS NULL
+        RETURNING id AS "id"
       `
 	});
-	const revokeOtherSessionRows = SqlSchema.findAll({
-		Request: RevokeOtherAuthSessionsInput,
-		Result: Schema$1.Struct({ sessionId: AuthSessionId }),
-		execute: ({ currentSessionId, revokedAt }) => sql`
-        UPDATE auth_sessions
-        SET revoked_at = ${revokedAt}
-        WHERE session_id <> ${currentSessionId}
-          AND revoked_at IS NULL
-        RETURNING session_id AS "sessionId"
+	const getPairingLinkRowByCredential = SqlSchema.findOneOption({
+		Request: GetAuthPairingLinkByCredentialInput,
+		Result: AuthPairingLinkRawDbRow,
+		execute: ({ credential }) => sql`
+        SELECT
+          id AS "id",
+          credential AS "credential",
+          method AS "method",
+          scopes AS "scopes",
+          subject AS "subject",
+          label AS "label",
+          proof_key_thumbprint AS "proofKeyThumbprint",
+          created_at AS "createdAt",
+          expires_at AS "expiresAt",
+          consumed_at AS "consumedAt",
+          revoked_at AS "revokedAt"
+        FROM auth_pairing_links
+        WHERE credential = ${credential}
       `
 	});
-	const create = (input) => createSessionRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthSessionRepository.create:query", "AuthSessionRepository.create:encodeRequest", { sessionId: input.sessionId })));
-	const getById = (input) => getSessionRowById(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthSessionRepository.getById:query", "AuthSessionRepository.getById:decodeRow", { sessionId: input.sessionId })), Effect.flatMap((rowOption) => Option.match(rowOption, {
+	const create = (input) => createPairingLinkRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthPairingLinkRepository.create:query", "AuthPairingLinkRepository.create:encodeRequest", { pairingLinkId: input.id })));
+	const consumeAvailable = (input) => consumeAvailablePairingLinkRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthPairingLinkRepository.consumeAvailable:query", "AuthPairingLinkRepository.consumeAvailable:decodeRow")), Effect.flatMap((rowOption) => Option.match(rowOption, {
 		onNone: () => Effect.succeed(Option.none()),
-		onSome: (row) => decodeAuthSessionDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthSessionRepository.getById:decodeRow", cause, { sessionId: input.sessionId })), Effect.map((decodedRow) => Option.some(toAuthSessionRecord(decodedRow))))
+		onSome: (row) => decodeAuthPairingLinkDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthPairingLinkRepository.consumeAvailable:decodeRow", cause, { pairingLinkId: row.id })), Effect.map(Option.some))
+	})));
+	const listActive = (input) => listActivePairingLinkRows(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthPairingLinkRepository.listActive:query", "AuthPairingLinkRepository.listActive:decodeRows")), Effect.flatMap((rows) => Effect.forEach(rows, (row) => decodeAuthPairingLinkDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthPairingLinkRepository.listActive:decodeRows", cause, { pairingLinkId: row.id }))))));
+	const revoke = (input) => revokePairingLinkRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthPairingLinkRepository.revoke:query", "AuthPairingLinkRepository.revoke:decodeRows", { pairingLinkId: input.id })), Effect.map((rows) => rows.length > 0));
+	const getByCredential = (input) => getPairingLinkRowByCredential(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthPairingLinkRepository.getByCredential:query", "AuthPairingLinkRepository.getByCredential:decodeRow")), Effect.flatMap((rowOption) => Option.match(rowOption, {
+		onNone: () => Effect.succeed(Option.none()),
+		onSome: (row) => decodeAuthPairingLinkDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthPairingLinkRepository.getByCredential:decodeRow", cause, { pairingLinkId: row.id })), Effect.map(Option.some))
 	})));
-	const listActive = (input) => listActiveSessionRows(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthSessionRepository.listActive:query", "AuthSessionRepository.listActive:decodeRows")), Effect.flatMap((rows) => Effect.forEach(rows, (row) => decodeAuthSessionDbRow(row).pipe(Effect.mapError((cause) => PersistenceDecodeError.fromSchemaError("AuthSessionRepository.listActive:decodeRows", cause, { sessionId: row.sessionId })), Effect.map(toAuthSessionRecord)))));
-	const revoke = (input) => revokeSessionRows(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthSessionRepository.revoke:query", "AuthSessionRepository.revoke:decodeRows", { sessionId: input.sessionId })), Effect.map((rows) => rows.length > 0));
-	const revokeAllExcept = (input) => revokeOtherSessionRows(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthSessionRepository.revokeAllExcept:query", "AuthSessionRepository.revokeAllExcept:decodeRows", { currentSessionId: input.currentSessionId })), Effect.map((rows) => rows.map((row) => row.sessionId)));
-	const setLastConnectedAt = (input) => setLastConnectedAtRow(input).pipe(Effect.mapError(toPersistenceSqlOrDecodeError$5("AuthSessionRepository.setLastConnectedAt:query", "AuthSessionRepository.setLastConnectedAt:encodeRequest", { sessionId: input.sessionId })));
 	return {
 		create,
-		getById,
+		consumeAvailable,
 		listActive,
 		revoke,
-		revokeAllExcept,
-		setLastConnectedAt
+		getByCredential
 	};
 });
-const layer$60 = Layer.effect(AuthSessionRepository, make$64);
+const layer$60 = Layer.effect(AuthPairingLinkRepository, make$64);
 //#endregion
-//#region src/auth/SessionStore.ts
-var MalformedSessionTokenError = class extends Schema$1.TaggedErrorClass()("MalformedSessionTokenError", {}) {
-	get message() {
-		return "Malformed session token.";
-	}
-};
-var InvalidSessionTokenSignatureError = class extends Schema$1.TaggedErrorClass()("InvalidSessionTokenSignatureError", {}) {
-	get message() {
-		return "Invalid session token signature.";
-	}
-};
-var InvalidSessionTokenPayloadError = class extends Schema$1.TaggedErrorClass()("InvalidSessionTokenPayloadError", { cause: Schema$1.Defect() }) {
-	get message() {
-		return "Invalid session token payload.";
-	}
-};
-var SessionTokenExpiredError = class extends Schema$1.TaggedErrorClass()("SessionTokenExpiredError", {
-	sessionId: AuthSessionId,
-	expiresAt: Schema$1.DateTimeUtc,
-	observedAt: Schema$1.DateTimeUtc
-}) {
-	get message() {
-		return "Session token expired.";
-	}
-};
-var UnknownSessionTokenError = class extends Schema$1.TaggedErrorClass()("UnknownSessionTokenError", { sessionId: AuthSessionId }) {
-	get message() {
-		return "Unknown session token.";
-	}
-};
-var SessionTokenRevokedError = class extends Schema$1.TaggedErrorClass()("SessionTokenRevokedError", {
-	sessionId: AuthSessionId,
-	revokedAt: Schema$1.DateTimeUtc
-}) {
-	get message() {
-		return "Session token revoked.";
-	}
-};
-var InvalidSessionExpirationClaimError = class extends Schema$1.TaggedErrorClass()("InvalidSessionExpirationClaimError", {
-	sessionId: AuthSessionId,
-	expirationClaim: Schema$1.Number
-}) {
-	get message() {
-		return "Invalid `exp` claim";
-	}
-};
-var MalformedWebSocketTokenError = class extends Schema$1.TaggedErrorClass()("MalformedWebSocketTokenError", {}) {
-	get message() {
-		return "Malformed websocket token.";
-	}
-};
-var InvalidWebSocketTokenSignatureError = class extends Schema$1.TaggedErrorClass()("InvalidWebSocketTokenSignatureError", {}) {
-	get message() {
-		return "Invalid websocket token signature.";
-	}
-};
-var InvalidWebSocketTokenPayloadError = class extends Schema$1.TaggedErrorClass()("InvalidWebSocketTokenPayloadError", { cause: Schema$1.Defect() }) {
-	get message() {
-		return "Invalid websocket token payload.";
-	}
-};
-var WebSocketTokenExpiredError = class extends Schema$1.TaggedErrorClass()("WebSocketTokenExpiredError", {
-	sessionId: AuthSessionId,
-	expiresAt: Schema$1.DateTimeUtc,
-	observedAt: Schema$1.DateTimeUtc
-}) {
+//#region src/auth/PairingGrantStore.ts
+var UnknownBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnknownBootstrapCredentialError", {}) {
 	get message() {
-		return "Websocket token expired.";
+		return "Unknown bootstrap credential.";
 	}
 };
-var UnknownWebSocketSessionError = class extends Schema$1.TaggedErrorClass()("UnknownWebSocketSessionError", { sessionId: AuthSessionId }) {
+var ExpiredBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("ExpiredBootstrapCredentialError", {}) {
 	get message() {
-		return "Unknown websocket session.";
+		return "Bootstrap credential expired.";
 	}
 };
-var WebSocketSessionExpiredError = class extends Schema$1.TaggedErrorClass()("WebSocketSessionExpiredError", {
-	sessionId: AuthSessionId,
-	expiresAt: Schema$1.DateTimeUtc,
-	observedAt: Schema$1.DateTimeUtc
-}) {
+var BootstrapCredentialProofKeyMismatchError = class extends Schema$1.TaggedErrorClass()("BootstrapCredentialProofKeyMismatchError", {}) {
 	get message() {
-		return "Websocket session expired.";
+		return "Bootstrap credential proof key mismatch.";
 	}
 };
-var WebSocketSessionRevokedError = class extends Schema$1.TaggedErrorClass()("WebSocketSessionRevokedError", {
-	sessionId: AuthSessionId,
-	revokedAt: Schema$1.DateTimeUtc
-}) {
+var UnavailableBootstrapCredentialError = class extends Schema$1.TaggedErrorClass()("UnavailableBootstrapCredentialError", {}) {
 	get message() {
-		return "Websocket session revoked.";
+		return "Bootstrap credential is no longer available.";
 	}
 };
-const SessionCredentialInvalidError = Schema$1.Union([
-	MalformedSessionTokenError,
-	InvalidSessionTokenSignatureError,
-	InvalidSessionTokenPayloadError,
-	SessionTokenExpiredError,
-	UnknownSessionTokenError,
-	SessionTokenRevokedError,
-	InvalidSessionExpirationClaimError,
-	MalformedWebSocketTokenError,
-	InvalidWebSocketTokenSignatureError,
-	InvalidWebSocketTokenPayloadError,
-	WebSocketTokenExpiredError,
-	UnknownWebSocketSessionError,
-	WebSocketSessionExpiredError,
-	WebSocketSessionRevokedError
+const BootstrapCredentialInvalidError = Schema$1.Union([
+	UnknownBootstrapCredentialError,
+	ExpiredBootstrapCredentialError,
+	BootstrapCredentialProofKeyMismatchError,
+	UnavailableBootstrapCredentialError
 ]);
-const isSessionCredentialInvalidError = Schema$1.is(SessionCredentialInvalidError);
-const sessionCredentialInternalErrorContext = { cause: Schema$1.Defect() };
-var SessionClaimsEncodingError = class extends Schema$1.TaggedErrorClass()("SessionClaimsEncodingError", {
-	sessionId: AuthSessionId,
-	operation: Schema$1.Literals(["encode_session_claims", "encode_websocket_claims"]),
-	...sessionCredentialInternalErrorContext
-}) {
-	get message() {
-		return "Failed to encode claims";
-	}
-};
-var SessionCredentialIssueError = class extends Schema$1.TaggedErrorClass()("SessionCredentialIssueError", {
-	sessionId: Schema$1.optional(AuthSessionId),
-	...sessionCredentialInternalErrorContext
-}) {
+Schema$1.is(BootstrapCredentialInvalidError);
+var ActivePairingLinksLoadError = class extends Schema$1.TaggedErrorClass()("ActivePairingLinksLoadError", { cause: Schema$1.Defect() }) {
 	get message() {
-		return "Failed to issue session credential.";
+		return "Failed to load active pairing links.";
 	}
 };
-var SessionCredentialVerificationError = class extends Schema$1.TaggedErrorClass()("SessionCredentialVerificationError", {
-	sessionId: AuthSessionId,
-	...sessionCredentialInternalErrorContext
+var PairingLinkRevokeError = class extends Schema$1.TaggedErrorClass()("PairingLinkRevokeError", {
+	pairingLinkId: Schema$1.String,
+	cause: Schema$1.Defect()
 }) {
 	get message() {
-		return "Failed to verify session credential.";
+		return `Failed to revoke pairing link '${this.pairingLinkId}'.`;
 	}
 };
-var WebSocketTokenIssueError = class extends Schema$1.TaggedErrorClass()("WebSocketTokenIssueError", {
-	sessionId: AuthSessionId,
-	...sessionCredentialInternalErrorContext
+var PairingCredentialIssueError = class extends Schema$1.TaggedErrorClass()("PairingCredentialIssueError", {
+	pairingLinkId: Schema$1.String,
+	subject: Schema$1.String,
+	label: Schema$1.optional(Schema$1.String),
+	cause: Schema$1.Defect()
 }) {
 	get message() {
-		return "Failed to issue websocket token.";
+		return `Failed to issue pairing credential '${this.pairingLinkId}' for '${this.subject}'.`;
 	}
 };
-var WebSocketTokenVerificationError = class extends Schema$1.TaggedErrorClass()("WebSocketTokenVerificationError", {
-	sessionId: AuthSessionId,
-	...sessionCredentialInternalErrorContext
+var PairingCredentialRandomGenerationError = class extends Schema$1.TaggedErrorClass()("PairingCredentialRandomGenerationError", {
+	operation: Schema$1.Literals(["generate-id", "generate-token"]),
+	cause: Schema$1.Defect()
 }) {
 	get message() {
-		return "Failed to verify websocket token.";
+		return `Failed to generate pairing credential data during '${this.operation}'.`;
 	}
 };
-var ActiveSessionsListError = class extends Schema$1.TaggedErrorClass()("ActiveSessionsListError", { ...sessionCredentialInternalErrorContext }) {
+var BootstrapCredentialConsumeError = class extends Schema$1.TaggedErrorClass()("BootstrapCredentialConsumeError", { cause: Schema$1.Defect() }) {
 	get message() {
-		return "Failed to list active sessions.";
+		return "Failed to consume bootstrap credential.";
 	}
 };
-var SessionRevocationError = class extends Schema$1.TaggedErrorClass()("SessionRevocationError", {
-	sessionId: AuthSessionId,
-	...sessionCredentialInternalErrorContext
-}) {
+var BootstrapCredentialConsumeAvailableError = class extends Schema$1.TaggedErrorClass()("BootstrapCredentialConsumeAvailableError", { cause: Schema$1.Defect() }) {
 	get message() {
-		return "Failed to revoke session.";
+		return "Failed to atomically consume an available bootstrap credential.";
 	}
 };
-var OtherSessionsRevocationError = class extends Schema$1.TaggedErrorClass()("OtherSessionsRevocationError", {
-	currentSessionId: AuthSessionId,
-	...sessionCredentialInternalErrorContext
-}) {
+var BootstrapCredentialLookupError = class extends Schema$1.TaggedErrorClass()("BootstrapCredentialLookupError", { cause: Schema$1.Defect() }) {
 	get message() {
-		return "Failed to revoke other sessions.";
+		return "Failed to look up bootstrap credential state.";
 	}
 };
-const SessionCredentialInternalError = Schema$1.Union([
-	SessionClaimsEncodingError,
-	SessionCredentialIssueError,
-	SessionCredentialVerificationError,
-	WebSocketTokenIssueError,
-	WebSocketTokenVerificationError,
-	ActiveSessionsListError,
-	SessionRevocationError,
-	OtherSessionsRevocationError
-]);
-Schema$1.is(SessionCredentialInternalError);
-const SessionCredentialError = Schema$1.Union([SessionCredentialInvalidError, SessionCredentialInternalError]);
-Schema$1.is(SessionCredentialError);
-var SessionStore = class extends Context.Service()("@p4code/cli/auth/SessionStore") {};
-const SIGNING_SECRET_NAME$1 = "server-signing-key";
-const DEFAULT_SESSION_TTL = Duration.days(30);
-const DEFAULT_WEBSOCKET_TOKEN_TTL = Duration.minutes(5);
-const SessionClaims = Schema$1.Struct({
-	v: Schema$1.Literal(1),
-	kind: Schema$1.Literal("session"),
-	sid: AuthSessionId,
-	sub: Schema$1.String,
-	scopes: AuthEnvironmentScopes,
-	method: Schema$1.Literals(["browser-session-cookie", "bearer-access-token"]),
-	jkt: Schema$1.optionalKey(Schema$1.String),
-	iat: Schema$1.Number,
-	exp: Schema$1.Number
-});
-const WebSocketClaims = Schema$1.Struct({
-	v: Schema$1.Literal(1),
-	kind: Schema$1.Literal("websocket"),
-	sid: AuthSessionId,
-	iat: Schema$1.Number,
-	exp: Schema$1.Number
-});
-const decodeSessionClaims = Schema$1.decodeUnknownEffect(Schema$1.fromJsonString(SessionClaims));
-const decodeWebSocketClaims = Schema$1.decodeUnknownEffect(Schema$1.fromJsonString(WebSocketClaims));
-function createDefaultClientMetadata() {
-	return { deviceType: "unknown" };
-}
-function toClientMetadata(record) {
-	return {
-		...record.label ? { label: record.label } : {},
-		...record.ipAddress ? { ipAddress: record.ipAddress } : {},
-		...record.userAgent ? { userAgent: record.userAgent } : {},
-		deviceType: record.deviceType,
-		...record.os ? { os: record.os } : {},
-		...record.browser ? { browser: record.browser } : {}
-	};
-}
-function toAuthClientSession(input) {
-	return {
-		...input,
-		current: false
-	};
-}
+const BootstrapCredentialInternalError = Schema$1.Union([
+	ActivePairingLinksLoadError,
+	PairingLinkRevokeError,
+	PairingCredentialIssueError,
+	PairingCredentialRandomGenerationError,
+	BootstrapCredentialConsumeError,
+	BootstrapCredentialConsumeAvailableError,
+	BootstrapCredentialLookupError
+]);
+const isBootstrapCredentialInternalError = Schema$1.is(BootstrapCredentialInternalError);
+const BootstrapCredentialError = Schema$1.Union([BootstrapCredentialInvalidError, BootstrapCredentialInternalError]);
+Schema$1.is(BootstrapCredentialError);
+var PairingGrantStore = class extends Context.Service()("@p4code/cli/auth/PairingGrantStore") {};
+const DEFAULT_ONE_TIME_TOKEN_TTL_MINUTES = Duration.minutes(5);
+const DESKTOP_BOOTSTRAP_TTL_HOURS = Duration.hours(24);
+const DEV_STARTUP_TTL_HOURS = Duration.hours(24);
+const PAIRING_TOKEN_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
+const PAIRING_TOKEN_LENGTH = 12;
+const PAIRING_TOKEN_REJECTION_LIMIT = Math.floor(256 / 32) * 32;
 const make$63 = Effect.gen(function* () {
 	const crypto = yield* Crypto.Crypto;
-	const serverConfig = yield* ServerConfig$1;
-	const secretStore = yield* ServerSecretStore;
-	const authSessions = yield* AuthSessionRepository;
-	const signingSecret = yield* secretStore.getOrCreateRandom(SIGNING_SECRET_NAME$1, 32);
-	const connectedSessionsRef = yield* Ref.make(/* @__PURE__ */ new Map());
+	const config = yield* ServerConfig$1;
+	const pairingLinks = yield* AuthPairingLinkRepository;
+	const seededGrantsRef = yield* Ref.make(/* @__PURE__ */ new Map());
 	const changesPubSub = yield* PubSub.unbounded();
-	const cookieName = resolveSessionCookieName({
-		mode: serverConfig.mode,
-		port: serverConfig.port,
-		host: serverConfig.host,
-		instanceKey: serverConfig.stateDir,
-		development: serverConfig.devUrl !== void 0
-	});
-	const emitUpsert = (clientSession) => PubSub.publish(changesPubSub, {
-		type: "clientUpserted",
-		clientSession
-	}).pipe(Effect.asVoid);
-	const emitRemoved = (sessionId) => PubSub.publish(changesPubSub, {
-		type: "clientRemoved",
-		sessionId
-	}).pipe(Effect.asVoid);
-	const loadActiveSession = (sessionId) => Effect.gen(function* () {
-		const row = yield* authSessions.getById({ sessionId });
-		if (Option.isNone(row) || row.value.revokedAt !== null) return Option.none();
-		const connectedSessions = yield* Ref.get(connectedSessionsRef);
-		return Option.some(toAuthClientSession({
-			sessionId: row.value.sessionId,
-			subject: row.value.subject,
-			scopes: row.value.scopes,
-			method: row.value.method,
-			client: toClientMetadata(row.value.client),
-			issuedAt: row.value.issuedAt,
-			expiresAt: row.value.expiresAt,
-			lastConnectedAt: row.value.lastConnectedAt,
-			connected: connectedSessions.has(row.value.sessionId)
-		}));
+	const generatePairingToken = Effect.gen(function* () {
+		let credential = "";
+		while (credential.length < PAIRING_TOKEN_LENGTH) {
+			const bytes = yield* crypto.randomBytes(PAIRING_TOKEN_LENGTH).pipe(Effect.mapError((cause) => new PairingCredentialRandomGenerationError({
+				operation: "generate-token",
+				cause
+			})));
+			for (const byte of bytes) {
+				if (byte >= PAIRING_TOKEN_REJECTION_LIMIT) continue;
+				credential += PAIRING_TOKEN_ALPHABET[byte % 32];
+				if (credential.length === PAIRING_TOKEN_LENGTH) return credential;
+			}
+		}
+		return credential;
 	});
-	const markConnected = (sessionId) => Ref.modify(connectedSessionsRef, (current) => {
-		const next = new Map(current);
-		const wasDisconnected = !next.has(sessionId);
-		next.set(sessionId, (next.get(sessionId) ?? 0) + 1);
-		return [wasDisconnected, next];
-	}).pipe(Effect.flatMap((wasDisconnected) => wasDisconnected ? DateTime.now.pipe(Effect.flatMap((lastConnectedAt) => authSessions.setLastConnectedAt({
-		sessionId,
-		lastConnectedAt
-	}))) : Effect.void), Effect.flatMap(() => loadActiveSession(sessionId)), Effect.flatMap((session) => Option.isSome(session) ? emitUpsert(session.value) : Effect.void), Effect.catchCause((cause) => Effect.logError("Failed to publish connected-session auth update.").pipe(Effect.annotateLogs({
-		sessionId,
-		cause
-	}))), Effect.withSpan("SessionStore.markConnected"));
-	const markDisconnected = (sessionId) => Ref.update(connectedSessionsRef, (current) => {
+	const seedGrant = (credential, grant) => Ref.update(seededGrantsRef, (current) => {
 		const next = new Map(current);
-		const remaining = (next.get(sessionId) ?? 0) - 1;
-		if (remaining > 0) next.set(sessionId, remaining);
-		else next.delete(sessionId);
+		next.set(credential, grant);
 		return next;
-	}).pipe(Effect.flatMap(() => loadActiveSession(sessionId)), Effect.flatMap((session) => Option.isSome(session) ? emitUpsert(session.value) : Effect.void), Effect.catchCause((cause) => Effect.logError("Failed to publish disconnected-session auth update.").pipe(Effect.annotateLogs({
-		sessionId,
-		cause
-	}))), Effect.withSpan("SessionStore.markDisconnected"));
-	const encodeClaims = Schema$1.encodeEffect(Schema$1.fromJsonString(SessionClaims));
-	const issue = Effect.fn("SessionStore.issue")(function* (input) {
-		const sessionId = AuthSessionId.make(yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new SessionCredentialIssueError({ cause }))));
-		const issuedAt = yield* DateTime.now;
-		const expiresAt = DateTime.add(issuedAt, { milliseconds: Duration.toMillis(input?.ttl ?? DEFAULT_SESSION_TTL) });
-		const claims = {
-			v: 1,
-			kind: "session",
-			sid: sessionId,
-			sub: input?.subject ?? "browser",
-			scopes: input?.scopes ?? AuthStandardClientScopes,
-			method: input?.method ?? "browser-session-cookie",
-			...input?.proofKeyThumbprint ? { jkt: input.proofKeyThumbprint } : {},
-			iat: issuedAt.epochMilliseconds,
-			exp: expiresAt.epochMilliseconds
-		};
-		const encodedPayload = yield* encodeClaims(claims).pipe(Effect.map(base64UrlEncode), Effect.mapError((cause) => new SessionCredentialIssueError({
-			sessionId,
-			cause: new SessionClaimsEncodingError({
-				sessionId,
-				operation: "encode_session_claims",
-				cause
-			})
-		})));
-		const signature = signPayload(encodedPayload, signingSecret);
-		const client = input?.client ?? createDefaultClientMetadata();
-		yield* authSessions.create({
-			sessionId,
-			subject: claims.sub,
-			scopes: claims.scopes,
-			method: claims.method,
-			client: {
-				label: client.label ?? null,
-				ipAddress: client.ipAddress ?? null,
-				userAgent: client.userAgent ?? null,
-				deviceType: client.deviceType,
-				os: client.os ?? null,
-				browser: client.browser ?? null
-			},
-			issuedAt,
-			expiresAt
-		}).pipe(Effect.mapError((cause) => new SessionCredentialIssueError({
-			sessionId,
-			cause
-		})));
-		yield* emitUpsert(toAuthClientSession({
-			sessionId,
-			subject: claims.sub,
-			scopes: claims.scopes,
-			method: claims.method,
-			client,
-			issuedAt,
-			expiresAt,
-			lastConnectedAt: null,
-			connected: false
-		}));
-		return {
-			sessionId,
-			token: `${encodedPayload}.${signature}`,
-			method: claims.method,
-			client,
-			expiresAt,
-			scopes: claims.scopes,
-			...claims.jkt ? { proofKeyThumbprint: claims.jkt } : {}
-		};
 	});
-	const verify = Effect.fn("SessionStore.verify")(function* (token) {
-		const [encodedPayload, signature] = token.split(".");
-		if (!encodedPayload || !signature) return yield* new MalformedSessionTokenError({});
-		if (!timingSafeEqualBase64Url(signature, signPayload(encodedPayload, signingSecret))) return yield* new InvalidSessionTokenSignatureError({});
-		const claims = yield* decodeSessionClaims(base64UrlDecodeUtf8(encodedPayload)).pipe(Effect.mapError((cause) => new InvalidSessionTokenPayloadError({ cause })));
-		const observedAt = yield* DateTime.now;
-		const expiresAt = DateTime.make(claims.exp);
-		if (Option.isNone(expiresAt)) return yield* new InvalidSessionExpirationClaimError({
-			sessionId: claims.sid,
-			expirationClaim: claims.exp
+	const emitUpsert = (pairingLink) => PubSub.publish(changesPubSub, {
+		type: "pairingLinkUpserted",
+		pairingLink
+	}).pipe(Effect.asVoid);
+	const emitRemoved = (id) => PubSub.publish(changesPubSub, {
+		type: "pairingLinkRemoved",
+		id
+	}).pipe(Effect.asVoid);
+	if (config.desktopBootstrapToken) {
+		const now = yield* DateTime.now;
+		yield* seedGrant(config.desktopBootstrapToken, {
+			method: "desktop-bootstrap",
+			scopes: AuthAdministrativeScopes,
+			subject: DESKTOP_BOOTSTRAP_SUBJECT,
+			expiresAt: DateTime.add(now, { milliseconds: Duration.toMillis(DESKTOP_BOOTSTRAP_TTL_HOURS) }),
+			remainingUses: "unbounded"
 		});
-		if (claims.exp <= observedAt.epochMilliseconds) return yield* new SessionTokenExpiredError({
-			sessionId: claims.sid,
-			expiresAt: expiresAt.value,
-			observedAt
+	}
+	const listActive = Effect.fn("PairingGrantStore.listActive")(function* () {
+		const now = yield* DateTime.now;
+		return (yield* pairingLinks.listActive({ now })).map((row) => row.label ? {
+			id: row.id,
+			credential: row.credential,
+			scopes: row.scopes,
+			subject: row.subject,
+			label: row.label,
+			createdAt: row.createdAt,
+			expiresAt: row.expiresAt
+		} : {
+			id: row.id,
+			credential: row.credential,
+			scopes: row.scopes,
+			subject: row.subject,
+			createdAt: row.createdAt,
+			expiresAt: row.expiresAt
 		});
-		const row = yield* authSessions.getById({ sessionId: claims.sid }).pipe(Effect.mapError((cause) => new SessionCredentialVerificationError({
-			sessionId: claims.sid,
+	}, Effect.mapError((cause) => new ActivePairingLinksLoadError({ cause })));
+	const revoke = Effect.fn("PairingGrantStore.revoke")(function* (id) {
+		const revokedAt = yield* DateTime.now;
+		const revoked = yield* pairingLinks.revoke({
+			id,
+			revokedAt
+		}).pipe(Effect.mapError((cause) => new PairingLinkRevokeError({
+			pairingLinkId: id,
 			cause
 		})));
-		if (Option.isNone(row)) return yield* new UnknownSessionTokenError({ sessionId: claims.sid });
-		if (row.value.revokedAt !== null) return yield* new SessionTokenRevokedError({
-			sessionId: claims.sid,
-			revokedAt: row.value.revokedAt
-		});
-		return {
-			sessionId: claims.sid,
-			token,
-			method: claims.method,
-			client: toClientMetadata(row.value.client),
-			expiresAt: expiresAt.value,
-			subject: claims.sub,
-			scopes: claims.scopes,
-			...claims.jkt ? { proofKeyThumbprint: claims.jkt } : {}
-		};
+		if (revoked) yield* emitRemoved(id);
+		return revoked;
 	});
-	const encodeWsClaims = Schema$1.encodeEffect(Schema$1.fromJsonString(WebSocketClaims));
-	const issueWebSocketToken = Effect.fn("SessionStore.issueWebSocketToken")(function* (sessionId, input) {
-		const issuedAt = yield* DateTime.now;
-		const expiresAt = DateTime.add(issuedAt, { milliseconds: Duration.toMillis(input?.ttl ?? DEFAULT_WEBSOCKET_TOKEN_TTL) });
-		const claims = {
-			v: 1,
-			kind: "websocket",
-			sid: sessionId,
-			iat: issuedAt.epochMilliseconds,
-			exp: expiresAt.epochMilliseconds
-		};
-		const encodedPayload = yield* encodeWsClaims(claims).pipe(Effect.map(base64UrlEncode), Effect.mapError((cause) => new WebSocketTokenIssueError({
-			sessionId,
-			cause: new SessionClaimsEncodingError({
-				sessionId,
-				operation: "encode_websocket_claims",
-				cause
-			})
+	const issueOneTimeToken = Effect.fn("PairingGrantStore.issueOneTimeToken")(function* (input) {
+		const id = yield* crypto.randomUUIDv4.pipe(Effect.mapError((cause) => new PairingCredentialRandomGenerationError({
+			operation: "generate-id",
+			cause
 		})));
-		return {
-			token: `${encodedPayload}.${signPayload(encodedPayload, signingSecret)}`,
+		const credential = yield* generatePairingToken;
+		const isDevStartupToken = config.devUrl !== void 0 && input?.purpose === "startup";
+		const ttl = input?.ttl ?? (isDevStartupToken ? DEV_STARTUP_TTL_HOURS : DEFAULT_ONE_TIME_TOKEN_TTL_MINUTES);
+		const now = yield* DateTime.now;
+		const expiresAt = DateTime.add(now, { milliseconds: Duration.toMillis(ttl) });
+		const issued = {
+			id,
+			credential,
+			...input?.label ? { label: input.label } : {},
+			...input?.proofKeyThumbprint ? { proofKeyThumbprint: input.proofKeyThumbprint } : {},
 			expiresAt
 		};
-	});
-	const verifyWebSocketToken = Effect.fn("SessionStore.verifyWebSocketToken")(function* (token) {
-		const [encodedPayload, signature] = token.split(".");
-		if (!encodedPayload || !signature) return yield* new MalformedWebSocketTokenError({});
-		if (!timingSafeEqualBase64Url(signature, signPayload(encodedPayload, signingSecret))) return yield* new InvalidWebSocketTokenSignatureError({});
-		const claims = yield* decodeWebSocketClaims(base64UrlDecodeUtf8(encodedPayload)).pipe(Effect.mapError((cause) => new InvalidWebSocketTokenPayloadError({ cause })));
-		const observedAt = yield* DateTime.now;
-		const expiresAt = DateTime.make(claims.exp);
-		if (Option.isNone(expiresAt)) return yield* new InvalidSessionExpirationClaimError({
-			sessionId: claims.sid,
-			expirationClaim: claims.exp
-		});
-		if (claims.exp <= observedAt.epochMilliseconds) return yield* new WebSocketTokenExpiredError({
-			sessionId: claims.sid,
-			expiresAt: expiresAt.value,
-			observedAt
-		});
-		const row = yield* authSessions.getById({ sessionId: claims.sid }).pipe(Effect.mapError((cause) => new WebSocketTokenVerificationError({
-			sessionId: claims.sid,
+		const subject = input?.subject ?? "one-time-token";
+		yield* pairingLinks.create({
+			id,
+			credential,
+			method: "one-time-token",
+			scopes: input?.scopes ?? AuthStandardClientScopes,
+			subject,
+			label: input?.label ?? null,
+			proofKeyThumbprint: input?.proofKeyThumbprint ?? null,
+			createdAt: now,
+			expiresAt
+		}).pipe(Effect.mapError((cause) => new PairingCredentialIssueError({
+			pairingLinkId: id,
+			subject,
+			...input?.label ? { label: input.label } : {},
 			cause
 		})));
-		if (Option.isNone(row)) return yield* new UnknownWebSocketSessionError({ sessionId: claims.sid });
-		if (row.value.expiresAt.epochMilliseconds <= observedAt.epochMilliseconds) return yield* new WebSocketSessionExpiredError({
-			sessionId: claims.sid,
-			expiresAt: row.value.expiresAt,
-			observedAt
-		});
-		if (row.value.revokedAt !== null) return yield* new WebSocketSessionRevokedError({
-			sessionId: claims.sid,
-			revokedAt: row.value.revokedAt
+		yield* emitUpsert({
+			id,
+			credential,
+			scopes: input?.scopes ?? AuthStandardClientScopes,
+			subject: input?.subject ?? "one-time-token",
+			...input?.label ? { label: input.label } : {},
+			createdAt: now,
+			expiresAt
 		});
-		return {
-			sessionId: row.value.sessionId,
-			token,
-			method: row.value.method,
-			client: toClientMetadata(row.value.client),
-			expiresAt: row.value.expiresAt,
-			subject: row.value.subject,
-			scopes: row.value.scopes
-		};
+		return issued;
 	});
-	const listActive = Effect.fn("SessionStore.listActive")(function* () {
+	const consume = Effect.fn("PairingGrantStore.consume")(function* (credential, input) {
 		const now = yield* DateTime.now;
-		const connectedSessions = yield* Ref.get(connectedSessionsRef);
-		return (yield* authSessions.listActive({ now })).map((row) => toAuthClientSession({
-			sessionId: row.sessionId,
-			subject: row.subject,
-			scopes: row.scopes,
-			method: row.method,
-			client: toClientMetadata(row.client),
-			issuedAt: row.issuedAt,
-			expiresAt: row.expiresAt,
-			lastConnectedAt: row.lastConnectedAt,
-			connected: connectedSessions.has(row.sessionId)
-		}));
-	}, Effect.mapError((cause) => new ActiveSessionsListError({ cause })));
-	const revoke = Effect.fn("SessionStore.revoke")(function* (sessionId) {
-		const revokedAt = yield* DateTime.now;
-		const revoked = yield* authSessions.revoke({
-			sessionId,
-			revokedAt
-		}).pipe(Effect.mapError((cause) => new SessionRevocationError({
-			sessionId,
-			cause
-		})));
-		if (revoked) {
-			yield* Ref.update(connectedSessionsRef, (current) => {
-				const next = new Map(current);
-				next.delete(sessionId);
-				return next;
-			});
-			yield* emitRemoved(sessionId);
-		}
-		return revoked;
-	});
-	const revokeAllExcept = Effect.fn("SessionStore.revokeAllExcept")(function* (sessionId) {
-		const revokedAt = yield* DateTime.now;
-		const revokedSessionIds = yield* authSessions.revokeAllExcept({
-			currentSessionId: sessionId,
-			revokedAt
-		}).pipe(Effect.mapError((cause) => new OtherSessionsRevocationError({
-			currentSessionId: sessionId,
-			cause
-		})));
-		if (revokedSessionIds.length > 0) {
-			yield* Ref.update(connectedSessionsRef, (current) => {
-				const next = new Map(current);
-				for (const revokedSessionId of revokedSessionIds) next.delete(revokedSessionId);
-				return next;
-			});
-			yield* Effect.forEach(revokedSessionIds, (revokedSessionId) => emitRemoved(revokedSessionId), {
-				concurrency: "unbounded",
-				discard: true
+		const seededResult = yield* Ref.modify(seededGrantsRef, (current) => {
+			const grant = current.get(credential);
+			if (!grant) return [{
+				_tag: "error",
+				reason: "not-found",
+				error: new UnknownBootstrapCredentialError({})
+			}, current];
+			const next = new Map(current);
+			if (DateTime.isGreaterThanOrEqualTo(now, grant.expiresAt)) {
+				next.delete(credential);
+				return [{
+					_tag: "error",
+					reason: "expired",
+					error: new ExpiredBootstrapCredentialError({})
+				}, next];
+			}
+			if (grant.proofKeyThumbprint && grant.proofKeyThumbprint !== input?.proofKeyThumbprint) return [{
+				_tag: "error",
+				reason: "not-found",
+				error: new BootstrapCredentialProofKeyMismatchError({})
+			}, next];
+			const remainingUses = grant.remainingUses;
+			if (typeof remainingUses === "number") if (remainingUses <= 1) next.delete(credential);
+			else next.set(credential, {
+				...grant,
+				remainingUses: remainingUses - 1
 			});
+			return [{
+				_tag: "success",
+				grant: {
+					method: grant.method,
+					scopes: grant.scopes,
+					subject: grant.subject,
+					...grant.label ? { label: grant.label } : {},
+					...grant.proofKeyThumbprint ? { proofKeyThumbprint: grant.proofKeyThumbprint } : {},
+					expiresAt: grant.expiresAt
+				}
+			}, next];
+		});
+		if (seededResult._tag === "success") return seededResult.grant;
+		if (seededResult.reason !== "not-found") return yield* seededResult.error;
+		const consumed = yield* pairingLinks.consumeAvailable({
+			credential,
+			proofKeyThumbprint: input?.proofKeyThumbprint ?? null,
+			consumedAt: now,
+			now
+		}).pipe(Effect.mapError((cause) => new BootstrapCredentialConsumeAvailableError({ cause })));
+		if (Option.isSome(consumed)) {
+			yield* emitRemoved(consumed.value.id);
+			return {
+				method: consumed.value.method,
+				scopes: consumed.value.scopes,
+				subject: consumed.value.subject,
+				...consumed.value.label ? { label: consumed.value.label } : {},
+				...consumed.value.proofKeyThumbprint ? { proofKeyThumbprint: consumed.value.proofKeyThumbprint } : {},
+				expiresAt: consumed.value.expiresAt
+			};
 		}
-		return revokedSessionIds.length;
+		const matching = yield* pairingLinks.getByCredential({ credential }).pipe(Effect.mapError((cause) => new BootstrapCredentialLookupError({ cause })));
+		if (Option.isNone(matching)) return yield* new UnknownBootstrapCredentialError({});
+		if (matching.value.revokedAt !== null) return yield* new UnavailableBootstrapCredentialError({});
+		if (matching.value.consumedAt !== null) return yield* new UnknownBootstrapCredentialError({});
+		if (DateTime.isGreaterThanOrEqualTo(now, matching.value.expiresAt)) return yield* new ExpiredBootstrapCredentialError({});
+		if (matching.value.proofKeyThumbprint !== null && matching.value.proofKeyThumbprint !== input?.proofKeyThumbprint) return yield* new BootstrapCredentialProofKeyMismatchError({});
+		return yield* new UnavailableBootstrapCredentialError({});
 	});
-	return SessionStore.of({
-		cookieName,
-		issue,
-		verify,
-		issueWebSocketToken,
-		verifyWebSocketToken,
+	return PairingGrantStore.of({
+		issueOneTimeToken,
 		listActive,
 		get streamChanges() {
 			return Stream.fromPubSub(changesPubSub);
 		},
 		revoke,
-		revokeAllExcept,
-		markConnected,
-		markDisconnected
+		consume
 	});
 });
-const layer$59 = Layer.effect(SessionStore, make$63).pipe(Layer.provideMerge(layer$60));
+const layer$59 = Layer.effect(PairingGrantStore, make$63).pipe(Layer.provideMerge(layer$60));
 //#endregion
 //#region src/persistence/Migrations/001_OrchestrationEvents.ts
 var _001_OrchestrationEvents_default = Effect.gen(function* () {
@@ -11848,8 +11908,8 @@ const make$62 = Effect.gen(function* () {
 		issueStartupPairingUrl
 	});
 });
-const layer$58 = Layer.effect(EnvironmentAuth, make$62).pipe(Layer.provideMerge(layer$62), Layer.provideMerge(layer$59), Layer.provideMerge(layer$64));
-const storageLayer = Layer.mergeAll(layer$61, layerConfig);
+const layer$58 = Layer.effect(EnvironmentAuth, make$62).pipe(Layer.provideMerge(layer$59), Layer.provideMerge(layer$61), Layer.provideMerge(layer$64));
+const storageLayer = Layer.mergeAll(layer$62, layerConfig);
 const runtimeLayer = layer$58.pipe(Layer.provideMerge(storageLayer));
 //#endregion
 //#region src/cliAuthFormat.ts
@@ -13703,7 +13763,7 @@ const assetNotFound = (name) => HttpServerResponse.jsonUnsafe({
 */
 const rejectOversizedAsset = Effect.fn("HubHttpServer.rejectOversizedAsset")(function* (input) {
 	const bytes = agentAssetTotalBytes(input.files);
-	if (bytes > 2097152) return yield* new InvalidHubRequest({ detail: `Asset is ${bytes} bytes, over the ${AGENT_ASSET_TOTAL_MAX_BYTES} byte limit.` });
+	if (bytes > 4194304) return yield* new InvalidHubRequest({ detail: `Asset is ${bytes} bytes, over the ${AGENT_ASSET_TOTAL_MAX_BYTES} byte limit.` });
 });
 const listAssetsRoute = HttpRouter.add("GET", "/assets", respondToHubFailures(Effect.gen(function* () {
 	yield* authenticateHubRequest();
@@ -14389,7 +14449,8 @@ const validateHubLink = (rawBaseUrl, rawToken) => {
 const StoredHubLink = Schema$1.fromJsonString(Schema$1.Struct({
 	baseUrl: Schema$1.String,
 	token: Schema$1.String,
-	syncMode: Schema$1.optional(Schema$1.Literals(["auto", "paused"]))
+	syncMode: Schema$1.optional(Schema$1.Literals(["auto", "paused"])),
+	shareMode: Schema$1.optional(Schema$1.Literals(["all", "selected"]))
 }));
 const decodeStoredHubLink = Schema$1.decodeUnknownExit(StoredHubLink);
 const encodeStoredHubLink = Schema$1.encodeSync(StoredHubLink);
@@ -14404,11 +14465,13 @@ const parseHubLink = (raw) => {
 	const decoded = decodeStoredHubLink(raw);
 	if (decoded._tag !== "Success") return {
 		settings: Option.none(),
-		syncMode: "auto"
+		syncMode: "auto",
+		shareMode: "all"
 	};
 	return {
 		settings: validateHubLink(decoded.value.baseUrl, decoded.value.token),
-		syncMode: decoded.value.syncMode ?? "auto"
+		syncMode: decoded.value.syncMode ?? "auto",
+		shareMode: decoded.value.shareMode ?? "all"
 	};
 };
 const formatHubLink = (input) => encodeStoredHubLink({
@@ -14420,7 +14483,8 @@ const formatHubLink = (input) => encodeStoredHubLink({
 		onNone: () => "",
 		onSome: (s) => s.token
 	}),
-	syncMode: input.syncMode
+	syncMode: input.syncMode,
+	shareMode: input.shareMode
 });
 const fromEnvironment = (environment) => validateHubLink(environment.P4CODE_HUB_URL ?? "", environment.P4CODE_HUB_TOKEN ?? "");
 const make$59 = Effect.fn("HubLink.make")(function* (environment) {
@@ -14432,7 +14496,8 @@ const make$59 = Effect.fn("HubLink.make")(function* (environment) {
 		return Option.match(stored, {
 			onNone: () => ({
 				settings: Option.none(),
-				syncMode: "auto"
+				syncMode: "auto",
+				shareMode: "all"
 			}),
 			onSome: (bytes) => parseHubLink(new TextDecoder().decode(bytes))
 		});
@@ -14440,10 +14505,12 @@ const make$59 = Effect.fn("HubLink.make")(function* (environment) {
 	const toState = (record) => Option.isSome(fromEnv) ? {
 		settings: fromEnv,
 		syncMode: record.syncMode,
+		shareMode: record.shareMode,
 		source: "environment"
 	} : {
 		settings: record.settings,
 		syncMode: record.syncMode,
+		shareMode: record.shareMode,
 		source: Option.isSome(record.settings) ? "stored" : "none"
 	};
 	const cache = yield* Ref.make(yield* readStored());
@@ -14459,23 +14526,30 @@ const make$59 = Effect.fn("HubLink.make")(function* (environment) {
 			if (Option.isNone(validated)) return yield* new InvalidHubLink({ detail: "A hub needs an http or https URL and a non-empty token." });
 			const record = yield* Ref.get(cache);
 			return yield* persist({
-				settings: validated,
-				syncMode: record.syncMode
+				...record,
+				settings: validated
 			});
 		}),
 		disconnect: Effect.gen(function* () {
 			const record = yield* Ref.get(cache);
 			return yield* persist({
-				settings: Option.none(),
-				syncMode: record.syncMode
+				...record,
+				settings: Option.none()
 			});
 		}),
 		setSyncMode: (mode) => Effect.gen(function* () {
 			const record = yield* Ref.get(cache);
 			return yield* persist({
-				settings: record.settings,
+				...record,
 				syncMode: mode
 			});
+		}),
+		setShareMode: (mode) => Effect.gen(function* () {
+			const record = yield* Ref.get(cache);
+			return yield* persist({
+				...record,
+				shareMode: mode
+			});
 		})
 	};
 });
@@ -14776,6 +14850,38 @@ const writeSkillManifest = Effect.fn("skillManifest.write")(function* (manifestP
 /** Bounded so a stray symlink or a vendored `node_modules` cannot walk forever. */
 const MAX_SKILL_DEPTH = 4;
 /**
+* Entries that are never part of a skill, skipped rather than refused.
+*
+* The distinction matters. Refusing an asset because it cannot be represented
+* faithfully is right — a half-materialized skill loads and misbehaves. But a
+* `.DS_Store` is not part of the skill at all, and macOS drops one into any
+* directory that has been opened in Finder, so refusing on its account rejects
+* a perfectly good skill for a reason its author cannot see.
+*
+* These could not sync in any case: `AgentAssetFilePath` rejects a leading dot,
+* so a dotfile has no representable path even if it were text.
+*/
+const IGNORED_ENTRIES = /* @__PURE__ */ new Set([
+	".DS_Store",
+	"Thumbs.db",
+	".git",
+	".svn",
+	".hg",
+	"node_modules",
+	"__pycache__",
+	".venv",
+	".pytest_cache",
+	".ruff_cache",
+	".mypy_cache"
+]);
+/**
+* Anything else with a leading dot is skipped too — an editor's `.idea`, a
+* `.gitignore` that belongs to the checkout rather than the skill. The rule is
+* the same one the path schema already enforces, applied earlier so it reads as
+* "not part of the skill" instead of "this skill is broken".
+*/
+const isIgnoredEntry = (entry) => IGNORED_ENTRIES.has(entry) || entry.startsWith(".");
+/**
 * A file is binary if decoding it yields a NUL.
 *
 * Cheap, and right for what is being asked: the question is not "is this valid
@@ -14791,6 +14897,7 @@ const readSkillFiles = Effect.fn("skillDirectory.readSkillFiles")(function* (roo
 		if (depth > MAX_SKILL_DEPTH) return "too-deep";
 		const entries = yield* fileSystem.readDirectory(directory).pipe(Effect.orElseSucceed(() => []));
 		for (const entry of [...entries].sort()) {
+			if (isIgnoredEntry(entry)) continue;
 			const absolute = path.join(directory, entry);
 			const relative = prefix === "" ? entry : `${prefix}/${entry}`;
 			const info = yield* fileSystem.stat(absolute).pipe(Effect.orElseSucceed(() => void 0));
@@ -14801,7 +14908,7 @@ const readSkillFiles = Effect.fn("skillDirectory.readSkillFiles")(function* (roo
 				continue;
 			}
 			if (info.type !== "File") continue;
-			if (files.length >= 64) return "too-many-files";
+			if (files.length >= 512) return "too-many-files";
 			const content = yield* fileSystem.readFileString(absolute).pipe(Effect.orElseSucceed(() => void 0));
 			if (content === void 0) return "unreadable";
 			if (looksBinary(content)) return "binary-file";
@@ -14815,7 +14922,7 @@ const readSkillFiles = Effect.fn("skillDirectory.readSkillFiles")(function* (roo
 	});
 	const refusal = yield* walk(root, "", 1);
 	if (refusal !== null) return { refusal };
-	if (agentAssetTotalBytes(files) > 2097152) return { refusal: "asset-too-large" };
+	if (agentAssetTotalBytes(files) > 4194304) return { refusal: "asset-too-large" };
 	return { files };
 });
 /**
@@ -14832,6 +14939,7 @@ const readSkillDirectory = Effect.fn("skillDirectory.readSkillDirectory")(functi
 	const skills = [];
 	const refused = [];
 	for (const entry of [...entries].sort()) {
+		if (isIgnoredEntry(entry)) continue;
 		const directory = path.join(skillsRoot, entry);
 		if ((yield* fileSystem.stat(directory).pipe(Effect.orElseSucceed(() => void 0)))?.type !== "Directory") continue;
 		if (!(yield* fileSystem.exists(path.join(directory, "SKILL.md")).pipe(Effect.orElseSucceed(() => false)))) continue;
@@ -15146,14 +15254,41 @@ const make$57 = Effect.gen(function* () {
 				break;
 		}
 		yield* writeSkillManifest(manifestPath, withEntriesFor(manifest, skillsRoot, [...entries.values()]));
+		const shareMode = (yield* link.current).shareMode;
+		const autoShared = [];
+		if (shareMode === "all") {
+			for (const name of plan.unmanaged) {
+				const skill = local.skills.find((entry) => entry.name === name);
+				if (skill === void 0) continue;
+				const written = yield* client.write({
+					kind: "skill",
+					name,
+					files: skill.files
+				}).pipe(Effect.option);
+				if (Option.isNone(written)) {
+					conflicts.push({
+						name,
+						reason: "unmanaged-local-collision"
+					});
+					continue;
+				}
+				entries.set(name, {
+					name,
+					version: written.value.version,
+					digest: digestSkillFiles(written.value.files)
+				});
+				autoShared.push(name);
+			}
+			yield* writeSkillManifest(manifestPath, withEntriesFor(manifest, skillsRoot, [...entries.values()]));
+		}
 		return {
 			ran: true,
 			skillsRoot,
 			materialized,
-			published,
+			published: [...published, ...autoShared],
 			removed,
 			conflicts,
-			unmanaged: plan.unmanaged,
+			unmanaged: plan.unmanaged.filter((name) => !autoShared.includes(name)),
 			refused: local.refused,
 			unavailable: null
 		};
@@ -15165,13 +15300,14 @@ const make$57 = Effect.gen(function* () {
 	* sharing the executing code path is one `if` away from writing during a
 	* preview, and this is the call a panel makes every time it opens.
 	*/
-	const status = Effect.gen(function* () {
+	const skillStatus = Effect.gen(function* () {
 		const state = yield* link.current;
 		const skillsRoot = yield* resolveSkillsRoot();
 		const local = yield* readSkillDirectory(skillsRoot);
 		const managed = entriesFor(yield* readSkillManifest(manifestPath), skillsRoot);
 		const base = {
 			syncMode: state.syncMode,
+			shareMode: state.shareMode,
 			source: state.source,
 			skillsRoot,
 			refused: local.refused
@@ -15256,6 +15392,7 @@ const make$57 = Effect.gen(function* () {
 		configured: false,
 		hubUrl: null,
 		syncMode: "auto",
+		shareMode: "all",
 		source: "none",
 		skillsRoot: null,
 		entries: [],
@@ -15313,6 +15450,27 @@ const make$57 = Effect.gen(function* () {
 			published: [name]
 		};
 	}).pipe(Effect.provide(services), Effect.catchCause((cause) => Effect.logWarning("skill publish failed", { cause }).pipe(Effect.as(EMPTY_REPORT))));
+	const publishAll = Effect.gen(function* () {
+		if (!(yield* isConfigured)) return EMPTY_REPORT;
+		const skillsRoot = yield* resolveSkillsRoot();
+		const status = yield* skillStatus;
+		const candidates = status.entries.filter((entry) => entry.state === "unmanaged").map((entry) => entry.name);
+		const published = [];
+		const conflicts = [];
+		for (const name of candidates) {
+			const report = yield* publish(name);
+			published.push(...report.published);
+			conflicts.push(...report.conflicts);
+		}
+		return {
+			...EMPTY_REPORT,
+			ran: true,
+			skillsRoot,
+			published,
+			conflicts,
+			refused: status.refused
+		};
+	}).pipe(Effect.provide(services), Effect.catchCause((cause) => Effect.logWarning("skill publish-all failed", { cause }).pipe(Effect.as(EMPTY_REPORT))));
 	const unpublish = (name) => Effect.gen(function* () {
 		if (!(yield* isConfigured)) return EMPTY_REPORT;
 		const skillsRoot = yield* resolveSkillsRoot();
@@ -15348,15 +15506,16 @@ const make$57 = Effect.gen(function* () {
 	}).pipe(Effect.provide(services), Effect.catchCause((cause) => Effect.logWarning("skill unpublish failed", { cause }).pipe(Effect.as(EMPTY_REPORT))));
 	return {
 		run,
-		status,
+		status: skillStatus,
 		publish,
+		publishAll,
 		unpublish
 	};
 });
 const layer$52 = Layer.effect(SkillSync, make$57);
 //#endregion
 //#region src/cli/skills.ts
-const SyncServicesLive = layer$52.pipe(Layer.provideMerge(layer$53), Layer.provideMerge(layer$54), Layer.provideMerge(layer$55.pipe(Layer.provide(layer$61))), Layer.provideMerge(layer$61), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$52.pipe(Layer.provideMerge(layer$53), Layer.provideMerge(layer$54), Layer.provideMerge(layer$55.pipe(Layer.provide(layer$62))), Layer.provideMerge(layer$62), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -15384,6 +15543,7 @@ const formatStatus = (status) => {
 	else {
 		lines.push(`Hub:   ${status.hubUrl ?? "unknown"}${status.source === "environment" ? "  (from the environment)" : ""}`);
 		lines.push(`Sync:  ${status.syncMode}`);
+		lines.push(`Share: ${status.shareMode === "all" ? "all skills (new ones share automatically)" : "only the ones you choose"}`);
 	}
 	if (status.skillsRoot !== null) lines.push(`Skills: ${status.skillsRoot}`);
 	if (status.unavailable !== null) lines.push(`Warning: ${status.unavailable}`);
@@ -15406,7 +15566,10 @@ const formatReport = (report) => {
 	if (report.removed.length > 0) parts.push(`removed ${report.removed.join(", ")}`);
 	for (const conflict of report.conflicts) parts.push(`CONFLICT on ${conflict.name} (${conflict.reason})`);
 	for (const refusal of report.refused) parts.push(`cannot sync ${refusal.name} (${refusal.reason})`);
-	return parts.length === 0 ? "Already up to date." : parts.join("\n");
+	const summary = parts.length === 0 ? "Already up to date." : parts.join("\n");
+	if (report.unmanaged.length === 0) return summary;
+	const count = report.unmanaged.length;
+	return `${summary}\n\n${count} local skill${count === 1 ? " is" : "s are"} not shared. Share ${count === 1 ? "it" : "them"} with:  p4 skills publish --all`;
 };
 const urlFlag = Flag.string("url").pipe(Flag.withDescription("Base URL of the hub, for example https://hub.example.com."));
 const tokenFlag = Flag.string("token").pipe(Flag.withDescription("Bearer token for this server, from `p4 hub token add`."));
@@ -15428,14 +15591,29 @@ const hubDisconnectCommand = Command.make("disconnect", { ...authLocationFlags }
 }))));
 const statusCommand = Command.make("status", { ...authLocationFlags }).pipe(Command.withDescription("Show which skills are shared, changed, or in conflict."), Command.withHandler((flags) => runWithSync(flags, ({ sync }) => sync.status.pipe(Effect.flatMap((s) => Console.log(formatStatus(s)))))));
 const syncCommand = Command.make("sync", { ...authLocationFlags }).pipe(Command.withDescription("Reconcile this machine's shared skills with the hub now."), Command.withHandler((flags) => runWithSync(flags, ({ sync }) => sync.run.pipe(Effect.flatMap((r) => Console.log(formatReport(r)))))));
+const allFlag = Flag.boolean("all").pipe(Flag.withDescription("Share every local skill this machine does not already share."));
 const publishCommand = Command.make("publish", {
 	...authLocationFlags,
-	name: skillNameArgument
-}).pipe(Command.withDescription("Share one local skill through the hub, so every machine gets it."), Command.withHandler((flags) => runWithSync(flags, ({ sync }) => sync.publish(flags.name).pipe(Effect.flatMap((report) => Console.log(formatReport(report)))))));
+	name: skillNameArgument.pipe(Argument.optional),
+	all: allFlag
+}).pipe(Command.withDescription("Share local skills through the hub, so every machine gets them."), Command.withHandler((flags) => runWithSync(flags, ({ sync }) => Effect.gen(function* () {
+	if (flags.all) return yield* sync.publishAll.pipe(Effect.flatMap((report) => Console.log(formatReport(report))));
+	const name = Option.getOrUndefined(flags.name);
+	if (name === void 0) return yield* Console.error("Name a skill, or pass --all to share every unshared one.");
+	return yield* sync.publish(name).pipe(Effect.flatMap((report) => Console.log(formatReport(report))));
+}))));
 const unpublishCommand = Command.make("unpublish", {
 	...authLocationFlags,
 	name: skillNameArgument
 }).pipe(Command.withDescription("Stop sharing a skill. It stays on this machine and leaves the others."), Command.withHandler((flags) => runWithSync(flags, ({ sync }) => sync.unpublish(flags.name).pipe(Effect.flatMap((report) => Console.log(formatReport(report)))))));
+const shareAllCommand = Command.make("share-all", { ...authLocationFlags }).pipe(Command.withDescription("Share every skill, including new ones, automatically. The default."), Command.withHandler((flags) => runWithSync(flags, ({ sync, link }) => Effect.gen(function* () {
+	yield* link.setShareMode("all");
+	yield* Console.log(formatStatus(yield* sync.status));
+}))));
+const shareSelectedCommand = Command.make("share-selected", { ...authLocationFlags }).pipe(Command.withDescription("Share only the skills you name with `publish`. Nothing shares on its own."), Command.withHandler((flags) => runWithSync(flags, ({ sync, link }) => Effect.gen(function* () {
+	yield* link.setShareMode("selected");
+	yield* Console.log(formatStatus(yield* sync.status));
+}))));
 const pauseCommand = Command.make("pause", { ...authLocationFlags }).pipe(Command.withDescription("Stop syncing automatically. `p4 skills sync` still works."), Command.withHandler((flags) => runWithSync(flags, ({ sync, link }) => Effect.gen(function* () {
 	yield* link.setSyncMode("paused");
 	yield* Console.log(formatStatus(yield* sync.status));
@@ -15450,7 +15628,9 @@ const skillsCommand = Command.make("skills", {}).pipe(Command.withDescription("S
 	publishCommand,
 	unpublishCommand,
 	pauseCommand,
-	resumeCommand
+	resumeCommand,
+	shareAllCommand,
+	shareSelectedCommand
 ]));
 /** Exported for the hub command, which owns `connect`/`disconnect`. */
 const hubLinkCommands = [hubConnectCommand, hubDisconnectCommand];
@@ -39446,9 +39626,11 @@ const RPC_REQUIRED_SCOPE = /* @__PURE__ */ new Map([
 	[WS_METHODS.hubConnect, AuthOrchestrationOperateScope],
 	[WS_METHODS.hubDisconnect, AuthOrchestrationOperateScope],
 	[WS_METHODS.hubSetSyncMode, AuthOrchestrationOperateScope],
+	[WS_METHODS.hubSetShareMode, AuthOrchestrationOperateScope],
 	[WS_METHODS.hubMintToken, AuthOrchestrationOperateScope],
 	[WS_METHODS.skillsSync, AuthOrchestrationOperateScope],
 	[WS_METHODS.skillsPublish, AuthOrchestrationOperateScope],
+	[WS_METHODS.skillsPublishAll, AuthOrchestrationOperateScope],
 	[WS_METHODS.skillsUnpublish, AuthOrchestrationOperateScope],
 	[WS_METHODS.serverGetSettings, AuthOrchestrationReadScope],
 	[WS_METHODS.serverUpdateSettings, AuthOrchestrationOperateScope],
@@ -40026,6 +40208,7 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 		[WS_METHODS.hubConnect]: (input) => observeRpcEffect$1(WS_METHODS.hubConnect, hubLink.connect(input).pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause.message })), Effect.andThen(skillSync.status)), { "rpc.aggregate": "hub" }),
 		[WS_METHODS.hubDisconnect]: (_input) => observeRpcEffect$1(WS_METHODS.hubDisconnect, hubLink.disconnect.pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause.message })), Effect.andThen(skillSync.status)), { "rpc.aggregate": "hub" }),
 		[WS_METHODS.hubSetSyncMode]: ({ mode }) => observeRpcEffect$1(WS_METHODS.hubSetSyncMode, hubLink.setSyncMode(mode).pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause.message })), Effect.andThen(skillSync.status)), { "rpc.aggregate": "hub" }),
+		[WS_METHODS.hubSetShareMode]: ({ mode }) => observeRpcEffect$1(WS_METHODS.hubSetShareMode, hubLink.setShareMode(mode).pipe(Effect.mapError((cause) => new HubLinkError({ detail: cause.message })), Effect.andThen(skillSync.status)), { "rpc.aggregate": "hub" }),
 		[WS_METHODS.hubMintToken]: (_input) => observeRpcEffect$1(WS_METHODS.hubMintToken, Effect.gen(function* () {
 			const token = yield* crypto.randomBytes(HUB_TOKEN_BYTES).pipe(Effect.map((bytes) => Buffer.from(bytes).toString("base64url")), Effect.orDie);
 			return {
@@ -40045,6 +40228,12 @@ const makeWsRpcLayer = (currentSession, previewAutomationBroker) => WsRpcGroup.t
 				status: yield* skillSync.status
 			};
 		}), { "rpc.aggregate": "skills" }),
+		[WS_METHODS.skillsPublishAll]: (_input) => observeRpcEffect$1(WS_METHODS.skillsPublishAll, Effect.gen(function* () {
+			return {
+				report: yield* skillSync.publishAll,
+				status: yield* skillSync.status
+			};
+		}), { "rpc.aggregate": "skills" }),
 		[WS_METHODS.skillsUnpublish]: ({ name }) => observeRpcEffect$1(WS_METHODS.skillsUnpublish, Effect.gen(function* () {
 			return {
 				report: yield* skillSync.unpublish(name),
@@ -81336,9 +81525,9 @@ const WorkspaceEntriesLayerLive = layer$26.pipe(Layer.provide(layer$42));
 const WorkspaceFileSystemLayerLive = layer$25.pipe(Layer.provide(layer$42), Layer.provide(WorkspaceEntriesLayerLive));
 const WorkspaceLayerLive = Layer.mergeAll(layer$42, WorkspaceEntriesLayerLive, WorkspaceFileSystemLayerLive);
 const ProjectFaviconResolverLayerLive = layer$40.pipe(Layer.provide(layer$42), Layer.provide(layer$41));
-const AuthLayerLive = layer$58.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$61));
+const AuthLayerLive = layer$58.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$62));
 const ProviderRuntimeLayerLive = ProviderSessionReaperLive.pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$50), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$55.pipe(Layer.provide(layer$61))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(layer$44), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$61)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$47), Layer.provideMerge(layer$49), Layer.provideMerge(layer$48), Layer.provide(layer$66));
+const RuntimeDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(CheckpointingLayerLive), Layer.provideMerge(SourceControlProviderRegistryLayerLive), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive)), Layer.provideMerge(PersistenceLayerLive), Layer.provideMerge(layer$50), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$55.pipe(Layer.provide(layer$62))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$51), Layer.provideMerge(layer$44), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$62)).pipe(Layer.provideMerge(layer$8), Layer.provideMerge(layer$7), Layer.provideMerge(layer$6), Layer.provideMerge(layer$47), Layer.provideMerge(layer$49), Layer.provideMerge(layer$48), Layer.provide(layer$66));
 /**
 * Hub asset sync.
 *