brane 0.0.2 → 0.3.0

package/dist/daemon/signal-source.js

@@ -0,0 +1,35 @@
+/**
+ * Who a `human_signal` is from, decided by the token that sent it, never by
+ * the request. Both ways in — `POST /api/narratives/:id/signal` and the
+ * control socket's `signal` message — used to take `source` from the body,
+ * so any token holder could write the operator's kind of event under any
+ * label, and an agent's token could post "web" signals into any narrative.
+ *
+ * A signal is the operator speaking. A device token is the operator's
+ * delegate (the app), and this account over `daemon.sock` is the operator's
+ * shell; an agent token is neither. An agent that wants to speak into
+ * another narrative narrates into it, which the daemon records as an
+ * `agent_signal` stamped with the agent's own narrative.
+ */
+/** The `source` stamped on a signal sent with each kind of token. "web" is
+ *  what the app always sent, so existing bubbles and new ones read alike. */
+export const SIGNAL_SOURCES = { device: "web", local: "local" };
+export const AGENT_SIGNAL_REFUSAL = "An agent's token cannot send a human_signal; narrate into the narrative instead (it arrives as an agent_signal)";
+/** The source to stamp, or the refusal to send. */
+export function signalStanding(record) {
+    if (record.kind === "agent")
+        return { refused: AGENT_SIGNAL_REFUSAL };
+    return { source: SIGNAL_SOURCES[record.kind] };
+}
+/** The fields a `human_signal` is appended with, given the token's standing
+ *  and the request (an HTTP body, or a control-socket message). `content`
+ *  and `re` come from the request; `source` never does, whatever it says. */
+export function signalEventFields(standing, request, payloads) {
+    return {
+        content: request.content,
+        source: standing.source,
+        re: request.re,
+        ...(payloads ? { payloads } : {}),
+    };
+}
+//# sourceMappingURL=signal-source.js.map

package/dist/daemon/tailscale-rebind.js

@@ -0,0 +1,58 @@
+// Tailscale re-probe policy for the daemon's listeners.
+//
+// `startServer` asks Tailscale for its addresses exactly once, at startup, and
+// binds to whatever comes back. That is the right first move and the wrong
+// last one: a `tailscale status` that times out — the extension wedged, the
+// app still launching after a reboot — leaves the daemon bound to loopback
+// only, and it stays that way for as long as it runs. Observed on 2026-08-30:
+// three consecutive daemon starts logged "No Tailscale detected" while the
+// Tailscale extension was hung, and the phone stayed locked out through the
+// recovery until the operator happened to restart the daemon again
+// (claude-9ya34xr8:13, :23).
+//
+// The policy here is window-free and pure so `src/test/tailscale-rebind.test.ts`
+// can pin it: how long to wait before asking again, and which of the addresses
+// an answer carries still need a listener.
+/** First retry after a probe that found nothing. */
+export const TAILSCALE_PROBE_INITIAL_MS = 5_000;
+/** Ceiling for the not-found backoff. */
+export const TAILSCALE_PROBE_MAX_MS = 60_000;
+/** Cadence once Tailscale has been seen — catches address changes and a
+ *  restart that came back with new IPs. */
+export const TAILSCALE_PROBE_STEADY_MS = 60_000;
+/**
+ * Delay before the next probe.
+ *
+ * Not found: exponential backoff from `TAILSCALE_PROBE_INITIAL_MS`, doubling
+ * up to `TAILSCALE_PROBE_MAX_MS`. A Tailscale that is starting up is usually
+ * ready within seconds; one that is wedged is not, and there is no point
+ * hammering a hung CLI.
+ *
+ * Found: `TAILSCALE_PROBE_STEADY_MS`, regardless of what came before.
+ */
+export function nextProbeDelay(previous, found) {
+    if (found)
+        return TAILSCALE_PROBE_STEADY_MS;
+    if (previous === null || previous <= 0)
+        return TAILSCALE_PROBE_INITIAL_MS;
+    return Math.min(previous * 2, TAILSCALE_PROBE_MAX_MS);
+}
+/**
+ * Addresses a probe returned that the daemon has not bound yet, in the order
+ * Tailscale reported them, without duplicates or blanks. An address that is
+ * already bound is never returned — rebinding it would throw EADDRINUSE
+ * against our own listener.
+ */
+export function addressesToBind(bound, probed) {
+    const have = new Set(bound);
+    const out = [];
+    for (const raw of probed) {
+        const addr = raw.trim();
+        if (!addr || have.has(addr))
+            continue;
+        have.add(addr);
+        out.push(addr);
+    }
+    return out;
+}
+//# sourceMappingURL=tailscale-rebind.js.map

package/dist/daemon/token-ring.js

@@ -0,0 +1,263 @@
+/**
+ * The daemon's bearer tokens, and how they change hands.
+ *
+ * **Only hashes are stored.** Every token is a random UUID the daemon hands
+ * out exactly once — to the device that asked, or to the agent session it
+ * launches — and keeps nothing but its SHA-256 in the `tokens` table
+ * (`src/db/tokens.ts`). That table therefore
+ * authenticates nothing by itself, and the daemon cannot print a token back:
+ * a device that needs one gets a freshly minted one (`POST /api/tokens`,
+ * which is what `brane meld` calls). This is a claim about the table, not
+ * about `brane.db`: events and captured tool calls are stored verbatim
+ * (`prepareCaptureText`, src/db/tool-uses.ts), so a token an agent printed or
+ * quoted is in the database in the clear until a rotation retires it. The tokens are 122 random bits, so a plain
+ * SHA-256 is the right hash; a slow one only helps a guessable secret.
+ *
+ * A `device` token is held by a web client as a durable credential — a
+ * registry entry written from a meld QR. This machine's own CLI and MCP
+ * bridges hold none: they reach the daemon over `daemon.sock` and present
+ * nothing, and act as the one live `local` row, the account row, which no
+ * token opens (`bootstrapTokens`, src/db/tokens.ts).
+ *
+ * Rotation is what "sign out other devices" means here. The hard part is not
+ * the rotation but not stranding the device that asked for it. The obvious
+ * shape — rotate returns the new token and the old dies on the spot — has one
+ * failure the request layer's own history makes real: on a satellite link, if
+ * the *response* is lost, the daemon has rotated and nobody holds the new
+ * token, the requester included. And a `POST` is rightly never retried, so
+ * the client cannot paper over it.
+ *
+ * So the swap happens **on first use**. `beginRotation` mints a *pending*
+ * token for the requester and changes nothing durable; every live token still
+ * authenticates. The first request that presents the pending token is the
+ * proof it arrived, and only then is it written down: it becomes a row of the
+ * requester's kind, and the requester's old row and every other device row
+ * are revoked — `authenticate` reports which, and the daemon closes the
+ * sockets they opened. The account row is never among them, so the CLI and
+ * MCP bridges ride through a phone's rotation the way they always have. A
+ * pending token nobody ever uses lapses after
+ * `ROTATION_GRACE_MS` and nothing has changed: a lost response costs nothing,
+ * and a restart mid-handshake (this state is in-memory) lands on the safe
+ * side.
+ *
+ * What rotation guarantees is only this: once it completes, holders of the
+ * requester's old token, and of every other device token, are out. It cannot
+ * stop a token holder from calling the route first — a token already grants
+ * keystrokes into every tmux session, so that adds nothing — but it must
+ * never *help* them, which is why a pending token is issued exactly once
+ * (see `beginRotation`).
+ *
+ * The shell's "sign out every device" (`brane token rotate`) needs none of
+ * that: it holds no token to swap, so nothing of its own can be stranded by
+ * a lost response, and `signOutDevices` revokes on the spot.
+ *
+ * Rows are revoked, never deleted.
+ */
+import { createHash, randomBytes } from "node:crypto";
+/** How long a minted-but-unused token stays valid before the rotation is
+ *  abandoned. Long enough for a slow link's round trip plus a reconnect;
+ *  short enough that a token stolen at the worst moment is not good for long
+ *  if the requester vanishes. */
+export const ROTATION_GRACE_MS = 60_000;
+/** How long a minted device token may sit unused before it lapses. A meld QR
+ *  is scanned on the spot; one that never was — every opening of the app's
+ *  Meld sheet mints one — would otherwise stay a full-power credential for
+ *  good, wherever the QR was photographed, and a phantom row in any devices
+ *  list. First use makes a token permanent, as before. Only minted device
+ *  tokens lapse: the account row and adopted ones are already in use. */
+/** Label for the token brane used before hashing, adopted as a device row so
+ *  every device that already holds it keeps working. Only a label: what marks
+ *  an adopted row is its `origin`, which no rename can change. */
+export const LEGACY_TOKEN_LABEL = "melded before hashing";
+/** What a rotation's replacement row is labelled when the requester's own
+ *  label was `LEGACY_TOKEN_LABEL`: the new token was minted, not melded
+ *  before hashing, and a label that says otherwise is wrong. */
+export const ROTATED_LEGACY_LABEL = "kept when other devices were signed out";
+export const UNUSED_TOKEN_LAPSE_MS = 10 * 60_000;
+export { WS_CLOSE_TOKEN_ROTATED } from "../shared/token-rotation.js";
+export function hashToken(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+/** A device token for a daemon on another machine (`brane meld --remote`),
+ *  and its hash. Nothing here stores either: only the hash goes to that
+ *  machine (`BRANE_DEVICE_TOKEN_SHA256`), which its daemon adopts at
+ *  startup, and the token goes no further than the QR. */
+export function mintRemoteToken() {
+    const token = randomBytes(32).toString("base64url");
+    return { token, hash: hashToken(token) };
+}
+export class TokenRing {
+    store;
+    mint;
+    pending = null;
+    constructor(store, mint) {
+        this.store = store;
+        this.mint = mint;
+    }
+    /** The unexpired pending rotation, if any; expiry is checked lazily here
+     *  rather than by a timer so the ring has no lifecycle of its own. */
+    pendingRotation(now = Date.now()) {
+        if (this.pending && this.pending.expiresAt <= now)
+            this.pending = null;
+        return this.pending;
+    }
+    /** Mint a new token and record only its hash — the caller hands the
+     *  plaintext to whoever asked and keeps no copy. */
+    issue(kind, label, now = Date.now(), opts = {}) {
+        const token = this.mint();
+        return { token, record: this.store.insert(hashToken(token), kind, label, now, opts) };
+    }
+    /** Mint a pending token for `requester`. A rotation already pending is
+     *  *replaced*, never re-issued: the only copy of a pending token must be
+     *  the response that minted it. Handing the same token to a second caller
+     *  would give it to exactly the party rotation exists to evict — anyone
+     *  holding a token can call this route too, and during the window they
+     *  would be handed the new one to use first. Replacing instead means a
+     *  racing rotate invalidates the requester's token, whose confirming
+     *  request then fails visibly (and `replaced` is logged) rather than
+     *  succeeding with a guest aboard. Nothing is lost for the honest retry: a
+     *  client that timed out has discarded the first response, so a fresh
+     *  token is as good.
+     *
+     *  Throws for a `local` requester. Completing a rotation writes a row of
+     *  the requester's kind under the new token, so one begun for this account
+     *  would put back a token that opens the `local` row — the copyable local
+     *  token `bootstrapTokens` retires. That "no token opens this machine's
+     *  row" must hold here, not only in the one route that calls this
+     *  (`gatedRotateRoute`, which sends this account to `signOutDevices`). */
+    beginRotation(requester, now = Date.now()) {
+        if (requester.kind === "local") {
+            throw new Error("This account holds no token to rotate; signOutDevices is what signs devices out for it");
+        }
+        const replaced = this.pendingRotation(now) !== null;
+        const token = this.mint();
+        this.pending = { hash: hashToken(token), requester, expiresAt: now + ROTATION_GRACE_MS };
+        return { token, expiresAt: this.pending.expiresAt, replaced };
+    }
+    /** Abandon a pending rotation begun by `tokenId`. Revoking a device must
+     *  also void a rotation it started: otherwise its pending token would
+     *  confirm afterwards and write the revoked device back in as a fresh row,
+     *  signing out everyone else on the way. Returns whether one was dropped. */
+    abandonRotationBy(tokenId) {
+        if (this.pending?.requester.id !== tokenId)
+            return false;
+        this.pending = null;
+        return true;
+    }
+    /** Sign out every device at once, for a requester that holds no token:
+     *  this account, over the daemon's socket. Revokes every live device row
+     *  and the externals they dialed in, and voids any pending rotation — its
+     *  requester is a device, which has just been signed out, and its pending
+     *  token must not write it back in. Returns the revoked ids, whose sockets
+     *  the caller closes, and how many of them were devices someone was signed
+     *  in on: an unscanned QR is revoked too, but it was nobody's device. */
+    signOutDevices(requester, now = Date.now()) {
+        const replaced = this.pendingRotation(now) !== null;
+        const result = this.store.transaction(() => {
+            const live = this.store.live("device");
+            const devices = live.map((d) => d.id);
+            this.store.revoke(devices, now);
+            const dependents = this.store.retireDependents?.(devices, requester.id, requester.id, now) ?? [];
+            return { ids: [...new Set([...devices, ...dependents])], devices: live.filter((d) => !d.unused).length };
+        });
+        this.pending = null;
+        return { ...result, replaced };
+    }
+    /** Authenticate a request that presented no token but arrived where only
+     *  this Unix account can reach (the daemon's socket, its directory
+     *  checked): it acts as the live `local` row. The caller decides the
+     *  "where"; this only says whether there is a row to act as. */
+    authenticateAccount(now = Date.now(), seen) {
+        const record = this.store.account?.(now, seen) ?? null;
+        return record ? { ok: true, record } : { ok: false };
+    }
+    /** Check a presented token. A live row always authenticates; the pending
+     *  token authenticates and, in doing so, is written down and retires the
+     *  requester's old row and every other device row — the caller gets
+     *  `retired` exactly once and is expected to act on it (close those rows'
+     *  sockets) before answering the request. */
+    authenticate(presented, now = Date.now(), seen) {
+        if (presented == null || presented === "")
+            return { ok: false };
+        const hash = hashToken(presented);
+        const record = this.store.find(hash, now, seen);
+        if (record)
+            return { ok: true, record };
+        const live = this.pendingRotation(now);
+        if (live && hash === live.hash) {
+            const { requester } = live;
+            // One transaction, so a rotation either completes or never happened: a
+            // new token that works while nobody was signed out is the failure this
+            // must not have. If it throws, the pending token survives for a retry.
+            const result = this.store.transaction(() => {
+                // Written as used: this very request is its first use, and a device
+                // that rotates and then only holds a socket open must not lapse. Its
+                // sighting is this request's — the device that asked to rotate.
+                const label = requester.label === LEGACY_TOKEN_LABEL ? ROTATED_LEGACY_LABEL : requester.label;
+                const replacement = this.store.insert(hash, requester.kind, label, now, { used: true, seen });
+                const ids = new Set([requester.id]);
+                for (const d of this.store.live("device"))
+                    if (d.id !== replacement.id)
+                        ids.add(d.id);
+                this.store.revoke([...ids], now);
+                for (const x of this.store.retireDependents?.([...ids], requester.id, replacement.id, now) ?? [])
+                    ids.add(x);
+                return { replacement, ids: [...ids] };
+            });
+            this.pending = null;
+            return { ok: true, record: result.replacement, retired: { ids: result.ids } };
+        }
+        return { ok: false };
+    }
+}
+/** A `TokenStore` in memory, for the suite and for anything that needs a
+ *  ring without a database. */
+export class MemoryTokenStore {
+    rows = new Map();
+    seq = 0;
+    /** Seed with plaintext tokens — only their hashes are kept. */
+    constructor(seed = []) {
+        for (const s of seed)
+            this.insert(hashToken(s.token), s.kind, s.label ?? s.kind);
+    }
+    find(hash) {
+        for (const r of this.rows.values()) {
+            if (r.hash === hash && r.revokedAt === null)
+                return { id: r.id, kind: r.kind, label: r.label };
+        }
+        return null;
+    }
+    insert(hash, kind, label) {
+        const id = `t${++this.seq}`;
+        this.rows.set(id, { id, kind, label, hash, revokedAt: null });
+        return { id, kind, label };
+    }
+    revoke(ids, now) {
+        for (const id of ids) {
+            const r = this.rows.get(id);
+            if (r && r.revokedAt === null)
+                r.revokedAt = now;
+        }
+    }
+    live(kind) {
+        return [...this.rows.values()]
+            .filter((r) => r.kind === kind && r.revokedAt === null)
+            .map(({ id, kind, label }) => ({ id, kind, label }));
+    }
+    account() {
+        return this.live("local")[0] ?? null;
+    }
+    transaction(fn) {
+        const snapshot = new Map([...this.rows].map(([id, r]) => [id, { ...r }]));
+        const seq = this.seq;
+        try {
+            return fn();
+        }
+        catch (err) {
+            this.rows = snapshot;
+            this.seq = seq;
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=token-ring.js.map

package/dist/daemon/token-routes.js

@@ -0,0 +1,190 @@
+/**
+ * The pieces of the token routes that hold their own logic, kept out of the
+ * server's closure so the suite can drive them (`src/test/token-routes.test.ts`,
+ * `src/test/token-devices.test.ts`): minting a device token, finishing a
+ * rotation, and the Devices list with its per-device revoke.
+ */
+import { describeUserAgent } from "../user-agent.js";
+import { UNUSED_TOKEN_LAPSE_MS, WS_CLOSE_TOKEN_ROTATED } from "./token-ring.js";
+const MAX_LABEL_LENGTH = 200;
+/** The label a `POST /api/tokens` body asks for, or why the body is refused.
+ *  Separate from minting so the route can refuse a bad body before it asks
+ *  the operator to approve anything (src/daemon/presence-gate.ts). */
+export function parseMintBody(rawBody, now = Date.now()) {
+    let parsed = {};
+    if (rawBody && rawBody.trim()) {
+        try {
+            parsed = JSON.parse(rawBody);
+        }
+        catch {
+            return { error: "Body must be a JSON object" };
+        }
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        return { error: "Body must be a JSON object" };
+    }
+    const { label } = parsed;
+    // Control characters become spaces: a label is logged and will be shown in
+    // a devices list, and a newline in either is a forged line.
+    const clean = typeof label === "string" ? label.replace(/[\u0000-\u001f\u007f-\u009f]/g, " ").trim() : "";
+    return { label: clean ? clean.slice(0, MAX_LABEL_LENGTH) : `melded ${new Date(now).toISOString().slice(0, 10)}` };
+}
+/** `POST /api/tokens`: mint a device token from a request body. The daemon
+ *  keeps only the hash, so the `token` in a 200 is the one and only copy, and
+ *  `expiresAt` is when it lapses if nothing has used it by then. An
+ *  empty body is fine (`brane meld` sends `{}` or nothing); a body that is not
+ *  a JSON object is a 400. */
+export function mintDeviceTokenRoute(ring, rawBody, now = Date.now(), 
+/** The requester's row: recorded on the new one, so the list can say which
+ *  device added which, and nothing later has to guess. */
+mintedBy) {
+    const parsed = parseMintBody(rawBody, now);
+    if ("error" in parsed)
+        return { status: 400, body: parsed };
+    const { token, record } = ring.issue("device", parsed.label, now, { mintedBy: mintedBy?.id });
+    return {
+        status: 200,
+        body: {
+            token,
+            id: record.id,
+            label: record.label,
+            expiresAt: now + UNUSED_TOKEN_LAPSE_MS,
+            // Relative too, for a client whose clock is not the daemon's.
+            validForMs: UNUSED_TOKEN_LAPSE_MS,
+        },
+    };
+}
+/** Finish a rotation, inside the request that first used the new token and
+ *  before it is answered: close every viewer socket opened under a revoked
+ *  row with 4401, and only those. */
+export function retireTokens(opts) {
+    return { closed: closeSocketsOf(opts.viewerSockets, opts.retired.ids, "token rotated") };
+}
+/** Whether a socket opened under `record` on `channel` must be closed when
+ *  that token is revoked or rotated away. Control and terminal sockets
+ *  always. An MCP socket only under a device token: a device token can open
+ *  `/ws/mcp`, which reaches every MCP tool, so a revoke that left it open
+ *  would leave the revoked token working for as long as it stayed connected;
+ *  an agent token's MCP socket is that agent's bridge, and closing it is what
+ *  revoking an agent means.
+ *  A local bridge is exempt — it dialed as this account, which is not what
+ *  a device revoke or rotation retires. */
+export function closesOnRevoke(channel, record) {
+    return channel !== "mcp" || record.kind !== "local";
+}
+/** Which rows own a socket. Usually one, the token that opened it. An MCP
+ *  socket bound to a narrative also belongs to that narrative's agent token,
+ *  whoever dialed it: a device's socket must close when the *device* is
+ *  revoked (the dialer), and an external's socket dialed as this account
+ *  must close when its *agent* is revoked (the narrative). Tagging only one
+ *  of the two is how a revoked device kept its MCP socket open
+ *  (claude-jrjh1e8w:13 #1). */
+export function socketOwners(channel, record, narrativeAgentToken) {
+    const ids = closesOnRevoke(channel, record) ? [record.id] : [];
+    if (channel === "mcp" && narrativeAgentToken && !ids.includes(narrativeAgentToken))
+        ids.push(narrativeAgentToken);
+    return ids;
+}
+/** Close every viewer socket opened under one of `ids` with 4401, the code
+ *  the app reads as "signed out" rather than a network blip, and forget it.
+ *  Returns how many it closed. */
+export function closeSocketsOf(viewerSockets, ids, reason = "token revoked") {
+    const revoked = new Set(ids);
+    let closed = 0;
+    for (const [ws, owners] of viewerSockets) {
+        const list = typeof owners === "string" ? [owners] : owners;
+        if (!list.some((id) => revoked.has(id)))
+            continue;
+        viewerSockets.delete(ws);
+        try {
+            ws.close(WS_CLOSE_TOKEN_ROTATED, reason);
+        }
+        catch { }
+        closed++;
+    }
+    return closed;
+}
+function withoutExternals(store, rootId, ids) {
+    const externals = new Set(store.externalsOf([rootId, ...ids]));
+    return ids.filter((id) => !externals.has(id));
+}
+/** `GET /api/tokens`: every live token, the local one included (shown, never
+ *  revocable from here). */
+export function listTokensRoute(store, requester, now = Date.now(), connected = new Set()) {
+    const launched = store.launched();
+    const tokens = store.list(now).map((t) => ({
+        ...t,
+        device: describeUserAgent(t.user_agent),
+        last_device: describeUserAgent(t.last_user_agent),
+        minted_by_device: t.minted_by === null
+            ? null
+            : t.minted_by_kind === "local"
+                ? "this machine"
+                : describeUserAgent(t.minted_by_user_agent) ?? "an unknown device",
+        current: t.id === requester.id,
+        connected: connected.has(t.id),
+        expires_at: t.unused ? t.created_at + UNUSED_TOKEN_LAPSE_MS : null,
+        // Externals are left out: they go with their dialer regardless, so
+        // offering them as a choice would be a checkbox that does nothing.
+        descendants: t.kind !== "local" && t.id !== requester.id ? withoutExternals(store, t.id, store.descendants(t.id, requester.id)) : [],
+        agents: launched.get(t.id) ?? [],
+    }));
+    return { status: 200, body: { tokens } };
+}
+/** What a revoke would do, or why it is refused, without doing it: the
+ *  checks of `revokeTokenRoute`, which the route runs before asking the
+ *  operator to approve a device's sign-out, so a request that would fail
+ *  never raises a prompt. The revoke itself runs them again, since the rows
+ *  can change while the prompt is up. */
+export function planRevoke(store, requester, id, also = []) {
+    const row = store.get(id);
+    if (!row)
+        return { status: 404, body: { error: "No live token with that id" } };
+    if (row.kind === "local") {
+        return { status: 400, body: { error: "That row is this machine's own account, which holds no token and cannot be revoked" } };
+    }
+    if (row.id === requester.id) {
+        return { status: 409, body: { error: "That is this device; use \"Sign out other devices\" to keep it and sign out the rest" } };
+    }
+    const allowed = new Set(store.descendants(row.id, requester.id));
+    const extra = [...new Set(also)];
+    const stray = extra.filter((x) => !allowed.has(x));
+    if (stray.length) {
+        return { status: 400, body: { error: `Not a device this one added: ${stray.join(", ")}` } };
+    }
+    const chosen = [row.id, ...extra];
+    // Plus the externals any of them dialed in, always: they are those
+    // tokens' credentials in another form, not devices of their own.
+    const ids = [...chosen, ...store.externalsOf(chosen).filter((x) => !chosen.includes(x))];
+    return { row, extra, ids };
+}
+/** `POST /api/tokens/:id/revoke`: revoke one device token. Bodiless, so the
+ *  app sends it without a preflight. Three refusals, each naming the route
+ *  that does what the caller probably meant:
+ *
+ *  - the account row (`local`): it is this machine's CLI and MCP bridges on
+ *    `daemon.sock`, which hold no token, so there is nothing to revoke;
+ *  - the requester's own token: a device revoking itself strands itself, and
+ *    "Sign out other devices" is the version that keeps it in;
+ *  - an id that is not live: 404, so a double-tap reads as already done.
+ *
+ *  On success the row is revoked (never deleted) and any rotation that device
+ *  had begun is abandoned — otherwise its pending token could confirm later
+ *  and write the device back in. The caller closes the row's sockets. */
+export function revokeTokenRoute(store, ring, requester, id, now = Date.now(), 
+/** Devices to revoke with it: each must be one this row added, directly or
+ *  down a chain, and not the requester or anything it added. Checked here,
+ *  so the list can never be used to revoke an unrelated device. */
+also = []) {
+    const plan = planRevoke(store, requester, id, also);
+    if ("status" in plan)
+        return plan;
+    const { row, extra, ids } = plan;
+    // One write: the device and the ones it added go together, or none do.
+    store.revoke(ids, now);
+    let abandonedRotation = false;
+    for (const x of ids)
+        abandonedRotation = ring.abandonRotationBy(x) || abandonedRotation;
+    return { status: 200, body: { revoked: row.id, kind: row.kind, label: row.label, also: extra, ids, abandonedRotation } };
+}
+//# sourceMappingURL=token-routes.js.map