ftown 0.20.9 → 0.21.0

package/dist/security-cli.js

@@ -1,9 +1,23 @@
 import { Command, CommanderError } from 'commander';
 import { readLocalPointer } from './local-pair-cli.js';
-import { apiResponse, securityCommand } from './cli-client.js';
-import { pendingPairingLink } from './security/bridge/pending-enrollment.js';
-import { resolveDefaultDataDir } from './ftown-home.js';
-import { readPendingBridgeStatus, submitPendingBridgeDecision } from './security/bridge/pending-approval.js';
+import { SecurityCommandError, apiResponse, securityCommand } from './cli-client.js';
+/** Printed instead of an invitation by an account bridge: its browsers come only from the passkey ledger (account_managed). */
+export const ACCOUNT_MANAGED_INVITE_MESSAGE = 'This computer belongs to your ftown account (account_managed): browsers sign in with your passkey and '
+    + 'appear in Security, so invitations are only for --local and --solo bridges.';
+/** A refusal whose own message is the explanation (not the generic "is the bridge running" line). */
+class SecurityCliRefusal extends Error {
+}
+/** The line printed for a security command the bridge refused: its typed code, explained when known. */
+export function securityRefusalMessage(error) {
+    if (error.code === 'account_managed') {
+        return 'This computer belongs to your ftown account (account_managed): its browsers come from your passkey ledger; add or remove them in Security.';
+    }
+    return `The bridge refused this security command: ${error.message}`;
+}
+/** An account bridge's pointer names its accountId as owner; Solo and --local name `solo:<bridgeId>`. */
+function accountManaged(ownerId) {
+    return typeof ownerId === 'string' && ownerId.length > 0 && !ownerId.startsWith('solo:');
+}
 export function invitationLink(invitation, apiUrl = 'https://ftown.ia.br') {
     const url = new URL('/connect', apiUrl);
     url.hash = `invite=${encodeURIComponent(JSON.stringify(invitation))}`;
@@ -13,22 +27,12 @@ export async function runSecurity(argv) {
     const program = new Command().name('ftown security').description('Manage this bridge’s encrypted endpoint trust')
         .option('--data-dir <path>', 'Bridge instance data directory').exitOverride();
     const pointer = () => readLocalPointer(program.opts().dataDir);
-    const dataDirectory = () => program.opts().dataDir ?? resolveDefaultDataDir();
-    program.command('pair-status').description('Display this computer’s local pending approval status and comparison code')
-        .action(async () => { console.log(JSON.stringify(await readPendingBridgeStatus(dataDirectory()))); });
-    program.command('pair-confirm <code>').description('Confirm the code matches your trusted browser (XXXX-XXXX-XXXX)')
-        .action(async (code) => { await submitPendingBridgeDecision(dataDirectory(), 'confirm', String(code)); console.log('Local comparison confirmed; waiting for trusted-device approval.'); });
-    program.command('pair-reject').description('Reject this computer’s current approval attempt')
-        .action(async () => { await submitPendingBridgeDecision(dataDirectory(), 'reject'); console.log('Local rejection recorded.'); });
-    program.command('pair-link').description('Display the current private first-computer approval link (explicit local output only)')
-        .action(async () => {
-        const dataDir = program.opts().dataDir;
-        console.log(await pendingPairingLink(dataDir ?? resolveDefaultDataDir()));
-    });
     program.command('invite').description('Create a one-use browser invitation (secret is printed only on this explicit request)')
         .option('--label <label>', 'Device label', 'Browser')
         .action(async (options) => {
         const current = pointer();
+        if (accountManaged(current.ownerId))
+            throw new SecurityCliRefusal(ACCOUNT_MANAGED_INVITE_MESSAGE);
         const invite = await securityCommand(current, 'security_invite', { label: String(options.label) });
         console.log(invitationLink(invite, current.apiUrl));
     });
@@ -70,6 +74,14 @@ export async function runSecurity(argv) {
     catch (error) {
         if (error instanceof CommanderError)
             return error.code === 'commander.helpDisplayed' ? 0 : error.exitCode;
+        if (error instanceof SecurityCliRefusal) {
+            console.error(error.message);
+            return 1;
+        }
+        if (error instanceof SecurityCommandError) {
+            console.error(securityRefusalMessage(error));
+            return 1;
+        }
         console.error('Encrypted local security operation failed. Check that the bridge is running and setup is current.');
         return 1;
     }

package/dist/security-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-cli.js","sourceRoot":"","sources":["../src/security-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAC;AAE7G,MAAM,UAAU,cAAc,CAAC,UAA4B,EAAE,MAAM,GAAG,qBAAqB;IACzF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,GAAG,UAAU,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAC,+CAA+C,CAAC;SAC9G,MAAM,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC,YAAY,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAA6B,CAAC,CAAC;IACrF,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAA6B,IAAI,qBAAqB,EAAE,CAAC;IACpG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,2EAA2E,CAAC;SACpH,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,uBAAuB,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,WAAW,CAAC,gEAAgE,CAAC;SACjH,MAAM,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,GAAG,MAAM,2BAA2B,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3L,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,iDAAiD,CAAC;SAC1F,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,2BAA2B,CAAC,aAAa,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,uFAAuF,CAAC;SAC9H,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAA6B,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,MAAM,kBAAkB,CAAC,OAAO,IAAI,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACL,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,uFAAuF,CAAC;SAC3H,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,SAAS,CAAC;SACpD,MAAM,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;QACtB,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAgC,CAAC;QAClI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACL,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACpG,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;QACjH,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5H,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,gEAAgE,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACvH,IAAI,KAAK,GAAG,CAAC,CAAC;QAAC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;YACtD,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;QAC9F,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;eAC7H,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;eACtE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;eACnE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpI,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EACpF,MAAM,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,cAAc;YAAE,OAAO,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1G,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAC/H,CAAC;AACH,CAAC"}
+{"version":3,"file":"security-cli.js","sourceRoot":"","sources":["../src/security-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGrF,+HAA+H;AAC/H,MAAM,CAAC,MAAM,8BAA8B,GAAG,wGAAwG;MAClJ,6EAA6E,CAAC;AAElF,qGAAqG;AACrG,MAAM,kBAAmB,SAAQ,KAAK;CAAG;AAEzC,wGAAwG;AACxG,MAAM,UAAU,sBAAsB,CAAC,KAA2B;IAChE,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrC,OAAO,4IAA4I,CAAC;IACtJ,CAAC;IACD,OAAO,6CAA6C,KAAK,CAAC,OAAO,EAAE,CAAC;AACtE,CAAC;AAED,yGAAyG;AACzG,SAAS,cAAc,CAAC,OAA2B;IACjD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAA4B,EAAE,MAAM,GAAG,qBAAqB;IACzF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,GAAG,UAAU,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;IACtE,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAC,+CAA+C,CAAC;SAC9G,MAAM,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC,YAAY,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAA6B,CAAC,CAAC;IACrF,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,uFAAuF,CAAC;SAC3H,MAAM,CAAC,iBAAiB,EAAE,cAAc,EAAE,SAAS,CAAC;SACpD,MAAM,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;QACtB,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,IAAI,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAgC,CAAC;QAClI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACL,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACpG,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;QACjH,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,iBAAiB,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5H,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,gEAAgE,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;QACvH,IAAI,KAAK,GAAG,CAAC,CAAC;QAAC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC3C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;YACtD,IAAI,KAAK,GAAG,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;QAC9F,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;eAC7H,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;eACtE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;eACnE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACpI,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EACpF,MAAM,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,YAAY,cAAc;YAAE,OAAO,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1G,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACpF,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACtG,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC;IAC/H,CAAC;AACH,CAAC"}

package/dist/token-provider.d.ts

@@ -0,0 +1,39 @@
+export interface ProvidedToken {
+    token: string;
+    /** The server's absolute expiry. Never compared with the local clock: reuse is timed from the JWT's own exp − iat. */
+    expiresAt: number;
+}
+export interface TokenProviderOptions {
+    /** One proof-signed relay-token exchange (createRelayTokenFetcher plus the caller's hooks). */
+    fetchToken: () => Promise<ProvidedToken>;
+    /** Monotonic clock in ms (cooldown, reuse window, remembered 401); injectable for tests. */
+    now?: () => number;
+    /** Jitter source in [0, 1); injectable for tests. */
+    random?: () => number;
+    /** The local ledger head: a remembered 401 is forgotten as soon as it changes. */
+    head?: () => string | null;
+}
+export interface TokenProvider {
+    /**
+     * A token while it has more than a minute left, else one shared exchange. Rejects (not as UnauthorizedError) while cooling down
+     * after transient failures, and rethrows a remembered UnauthorizedError for 10 minutes or until the local ledger head changes.
+     */
+    getToken(): Promise<string>;
+    cooldownRemainingMs(): number;
+}
+/** exp − iat of a JWT in ms (capped at 2 h), or null when it is not a JWT with a positive numeric lifetime. */
+export declare function tokenLifetimeMs(token: string): number | null;
+/**
+ * Owns the bridge's relay (Centrifugo) token. There is no stored credential: every exchange proves the bridge auth key.
+ *
+ * Exchanges are single-flight: concurrent callers (centrifuge-js, the push notifier, the endpoint directory) share one. A token is
+ * reused until a minute before it expires, timed on the monotonic clock from its arrival and its own exp − iat, so a skewed local
+ * clock can neither stretch nor shrink it.
+ *
+ * Transient failures (network errors, 5xx) arm an exponential cooldown (15 s doubling to 10 min, ±20% jitter) during which getToken()
+ * rejects without calling the server, because centrifuge-js retries a failed token fetch every 5-10 s with no growth. The cooldown error
+ * is deliberately not an UnauthorizedError: centrifuge-js treats that as permanent and stops retrying for good. An UnauthorizedError
+ * never arms the cooldown and propagates as is; it is remembered (10 min, or until the local ledger head changes) so a refused key is
+ * not re-proven on every call. A success resets the cooldown and the memory.
+ */
+export declare function createTokenProvider(options: TokenProviderOptions): TokenProvider;

package/dist/token-provider.js

@@ -0,0 +1,101 @@
+import { UnauthorizedError } from 'centrifuge';
+const COOLDOWN_BASE_MS = 15_000;
+const COOLDOWN_MAX_MS = 600_000;
+/** A token is reused until this long before it expires. */
+const REUSE_MARGIN_MS = 60_000;
+/** A refused key is not retried for this long, unless the local ledger changes. */
+const UNAUTHORIZED_MEMORY_MS = 600_000;
+/** A server that claims a longer lifetime is not believed beyond this. */
+const MAX_LIFETIME_MS = 2 * 3_600_000;
+/** exp − iat of a JWT in ms (capped at 2 h), or null when it is not a JWT with a positive numeric lifetime. */
+export function tokenLifetimeMs(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3 || parts[1].length === 0)
+        return null;
+    let claims;
+    try {
+        claims = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (typeof claims !== 'object' || claims === null || Array.isArray(claims))
+        return null;
+    const { exp, iat } = claims;
+    if (typeof exp !== 'number' || typeof iat !== 'number' || !Number.isFinite(exp) || !Number.isFinite(iat))
+        return null;
+    const lifetime = (exp - iat) * 1000;
+    return lifetime > 0 ? Math.min(lifetime, MAX_LIFETIME_MS) : null;
+}
+/**
+ * Owns the bridge's relay (Centrifugo) token. There is no stored credential: every exchange proves the bridge auth key.
+ *
+ * Exchanges are single-flight: concurrent callers (centrifuge-js, the push notifier, the endpoint directory) share one. A token is
+ * reused until a minute before it expires, timed on the monotonic clock from its arrival and its own exp − iat, so a skewed local
+ * clock can neither stretch nor shrink it.
+ *
+ * Transient failures (network errors, 5xx) arm an exponential cooldown (15 s doubling to 10 min, ±20% jitter) during which getToken()
+ * rejects without calling the server, because centrifuge-js retries a failed token fetch every 5-10 s with no growth. The cooldown error
+ * is deliberately not an UnauthorizedError: centrifuge-js treats that as permanent and stops retrying for good. An UnauthorizedError
+ * never arms the cooldown and propagates as is; it is remembered (10 min, or until the local ledger head changes) so a refused key is
+ * not re-proven on every call. A success resets the cooldown and the memory.
+ */
+export function createTokenProvider(options) {
+    const now = options.now ?? (() => performance.now());
+    const random = options.random ?? Math.random;
+    const head = options.head ?? (() => null);
+    let inFlight = null;
+    let cached = null;
+    let refused = null;
+    let consecutiveFailures = 0;
+    let cooldownUntil = 0;
+    const cooldownRemainingMs = () => Math.max(0, cooldownUntil - now());
+    const armCooldown = () => {
+        consecutiveFailures++;
+        const base = Math.min(COOLDOWN_BASE_MS * 2 ** (consecutiveFailures - 1), COOLDOWN_MAX_MS);
+        cooldownUntil = now() + base * (0.8 + 0.4 * random());
+    };
+    const exchange = async () => {
+        try {
+            const fetched = await options.fetchToken();
+            const arrivedAt = now();
+            consecutiveFailures = 0;
+            cooldownUntil = 0;
+            refused = null;
+            const lifetime = tokenLifetimeMs(fetched.token);
+            cached = lifetime === null ? null : { token: fetched.token, reuseUntil: arrivedAt + lifetime - REUSE_MARGIN_MS };
+            return fetched.token;
+        }
+        catch (error) {
+            if (error instanceof UnauthorizedError)
+                refused = { error, until: now() + UNAUTHORIZED_MEMORY_MS, head: head() };
+            else
+                armCooldown();
+            throw error;
+        }
+    };
+    const getToken = () => {
+        if (inFlight)
+            return inFlight;
+        if (cached !== null && now() < cached.reuseUntil)
+            return Promise.resolve(cached.token);
+        cached = null;
+        if (refused !== null) {
+            if (now() < refused.until && head() === refused.head)
+                return Promise.reject(refused.error);
+            refused = null;
+        }
+        const remaining = cooldownRemainingMs();
+        if (remaining > 0) {
+            return Promise.reject(new Error(`Token refresh cooling down for ${Math.ceil(remaining / 1000)}s after ${consecutiveFailures} failed attempts`));
+        }
+        const operation = exchange().finally(() => {
+            if (inFlight === operation)
+                inFlight = null;
+        });
+        inFlight = operation;
+        return operation;
+    };
+    return { getToken, cooldownRemainingMs };
+}
+//# sourceMappingURL=token-provider.js.map

package/dist/token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-provider.js","sourceRoot":"","sources":["../src/token-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA4B/C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,2DAA2D;AAC3D,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,mFAAmF;AACnF,MAAM,sBAAsB,GAAG,OAAO,CAAC;AACvC,0EAA0E;AAC1E,MAAM,eAAe,GAAG,CAAC,GAAG,SAAS,CAAC;AAEtC,+GAA+G;AAC/G,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACxG,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAA0C,CAAC;IAChE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtH,MAAM,QAAQ,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;IACpC,OAAO,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,MAAM,GAAiD,IAAI,CAAC;IAChE,IAAI,OAAO,GAAkE,IAAI,CAAC;IAClF,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,mBAAmB,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,GAAG,EAAE,CAAC,CAAC;IAE7E,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,mBAAmB,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAC1F,aAAa,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,IAAqB,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;YACxB,mBAAmB,GAAG,CAAC,CAAC;YACxB,aAAa,GAAG,CAAC,CAAC;YAClB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,GAAG,QAAQ,GAAG,eAAe,EAAE,CAAC;YACjH,OAAO,OAAO,CAAC,KAAK,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,iBAAiB;gBAAE,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;;gBAC5G,WAAW,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAoB,EAAE;QACrC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvF,MAAM,GAAG,IAAI,CAAC;QAEd,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,OAAO,CAAC,IAAI;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3F,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;QACxC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,WAAW,mBAAmB,kBAAkB,CAAC,CAAC,CAAC;QAClJ,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACxC,IAAI,QAAQ,KAAK,SAAS;gBAAE,QAAQ,GAAG,IAAI,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,QAAQ,GAAG,SAAS,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;AAC3C,CAAC"}

package/dist/types.d.ts

@@ -90,7 +90,7 @@ export interface Command {
     payload: CommandPayload;
     requestId: string;
 }
-export type CommandType = 'get_pull_request_review' | 'get_pull_request_review_chunk' | 'preview_chat_list' | 'preview_chat_send' | 'preview_chat_reply' | 'get_pull_request_statuses' | 'session_preview_status' | 'session_preview_chunk' | 'get_bridge_update' | 'update_bridge' | 'security_devices' | 'security_invite' | 'security_revoke' | 'security_account_adopt' | 'create_session' | 'stop_session' | 'list_sessions' | 'get_history' | 'retry_session' | 'send_message' | 'rename_session' | 'remove_session' | 'bridge_exec' | 'clear_terminal' | 'update_session_parent' | 'get_session_usage' | 'get_sessions_usage' | 'get_session_attention' | 'resolve_session_attention' | 'answer_session_attention';
+export type CommandType = 'get_pull_request_review' | 'get_pull_request_review_chunk' | 'preview_chat_list' | 'preview_chat_send' | 'preview_chat_reply' | 'get_pull_request_statuses' | 'session_preview_status' | 'session_preview_chunk' | 'get_bridge_update' | 'update_bridge' | 'security_devices' | 'security_invite' | 'security_revoke' | 'create_session' | 'stop_session' | 'list_sessions' | 'get_history' | 'retry_session' | 'send_message' | 'rename_session' | 'remove_session' | 'bridge_exec' | 'clear_terminal' | 'update_session_parent' | 'get_session_usage' | 'get_sessions_usage' | 'get_session_attention' | 'resolve_session_attention' | 'answer_session_attention';
 export interface GetSessionAttentionPayload {
     bridgeId: string;
     sessionId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ftown",
-  "version": "0.20.9",
+  "version": "0.21.0",
   "description": "CLI bridge for ftown — generic PTY-over-Centrifugo relay",
   "type": "module",
   "main": "dist/index.js",
@@ -72,5 +72,5 @@
   "overrides": {
     "qs": "6.16.1"
   },
-  "gitHead": "5a848f9cc48b41cd647b44b75a739a8b665b48eb"
+  "gitHead": "47c0c38840ff1e0dfb6d8d7fe1c622dc560b9538"
 }

package/skills/ftown/references/sessions.md

@@ -320,8 +320,9 @@ launchers, `~/.ftown/notify.sh`, and updates the unified skill
 under `~/.ftown/skills/ftown/` (linked into ~/.agents/skills and
 ~/.claude/skills).
 
-A computer removed from the account resets its own identity, keeps its tmux sessions, and shows a new
-pairing link; `ftown start --new-identity` does the same by hand.
+An unpaired `ftown start` prints a `/pair` link and a 6-digit code: open the link on a device with the
+account passkey and type the code. A computer removed from the account resets its own identity, keeps its
+tmux sessions, and shows a new pairing link; `ftown start --new-identity` does the same by hand.
 
 ### Automatic PR result mail
 

package/dist/bridge-auth.d.ts

@@ -1,31 +0,0 @@
-import { UnauthorizedError } from 'centrifuge';
-import type { AccountEnrollmentBundle, AccountHistory } from './security/account-protocol.js';
-/** Loopback advert embedded in the Centrifugo connection JWT `info` claim (L2). */
-export interface BridgeLocalAdvert {
-    localPort: number;
-    localNonce: string;
-}
-export interface BridgeAuthResponse {
-    ownerId: string;
-    token: string;
-    refreshToken: string;
-    centrifugoUrl: string;
-    userId: string;
-    accountApproval?: AccountEnrollmentBundle;
-    accountHistory?: AccountHistory;
-}
-/** A 401 refresh that carries signed revocation evidence; still terminal for centrifuge-js. */
-export declare class BridgeRevokedError extends UnauthorizedError {
-    readonly evidence: AccountHistory;
-    constructor(evidence: AccountHistory);
-}
-export declare function fetchBridgeToken(apiUrl: string, authToken: string, bridgeId: string, local: BridgeLocalAdvert): Promise<BridgeAuthResponse>;
-/**
- * Exchange a (rotating) refresh token for a fresh Centrifugo connect token.
- *
- * The server rotates the refresh token on every use (audit finding F3): the
- * response carries a NEW refreshToken that supersedes the one just sent, so the
- * caller must persist it and send the newest value next time. Reusing an old
- * refresh token is rejected.
- */
-export declare function refreshBridgeToken(apiUrl: string, refreshToken: string, bridgeId: string, local: BridgeLocalAdvert): Promise<BridgeAuthResponse>;

package/dist/bridge-auth.js

@@ -1,70 +0,0 @@
-import { hostname as osHostname } from 'node:os';
-import { UnauthorizedError } from 'centrifuge';
-import { parseBridgeRevokedBody } from './security/bridge/revocation.js';
-/** A 401 refresh that carries signed revocation evidence; still terminal for centrifuge-js. */
-export class BridgeRevokedError extends UnauthorizedError {
-    evidence;
-    constructor(evidence) {
-        super('Bridge revoked');
-        this.name = 'BridgeRevokedError';
-        this.evidence = evidence;
-    }
-}
-export async function fetchBridgeToken(apiUrl, authToken, bridgeId, local) {
-    const res = await fetch(`${apiUrl}/api/auth/bridge`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            token: authToken,
-            bridgeId,
-            hostname: osHostname(),
-            // Embedded in the Centrifugo connection JWT `info` claim so the owning
-            // user's clients discover the loopback WS rung via presence (L2).
-            localPort: local.localPort,
-            // Local port is discovery only; no cloud-visible local authorization secret.
-        }),
-    });
-    if (!res.ok) {
-        const body = await res.text();
-        throw new Error(`Bridge auth failed (${res.status}): ${body}`);
-    }
-    return res.json();
-}
-/**
- * Exchange a (rotating) refresh token for a fresh Centrifugo connect token.
- *
- * The server rotates the refresh token on every use (audit finding F3): the
- * response carries a NEW refreshToken that supersedes the one just sent, so the
- * caller must persist it and send the newest value next time. Reusing an old
- * refresh token is rejected.
- */
-export async function refreshBridgeToken(apiUrl, refreshToken, bridgeId, local) {
-    const res = await fetch(`${apiUrl}/api/auth/bridge/refresh`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            refreshToken,
-            bridgeId,
-            hostname: osHostname(),
-            localPort: local.localPort,
-            // Local port is discovery only; no cloud-visible local authorization secret.
-        }),
-    });
-    if (!res.ok) {
-        const body = await res.text();
-        // Capped: a malformed or oversized 401 body must not flood the logged error message.
-        const message = `Token refresh failed (${res.status}): ${body.slice(0, 200)}`;
-        // A rejected bridge credential cannot become valid through retrying.
-        // centrifuge-js only stops its token retry loop for UnauthorizedError;
-        // ordinary errors are treated as transient and retried indefinitely.
-        if (res.status === 401) {
-            const evidence = parseBridgeRevokedBody(body);
-            if (evidence !== null)
-                throw new BridgeRevokedError(evidence);
-            throw new UnauthorizedError(message);
-        }
-        throw new Error(message);
-    }
-    return res.json();
-}
-//# sourceMappingURL=bridge-auth.js.map

package/dist/bridge-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bridge-auth.js","sourceRoot":"","sources":["../src/bridge-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAkBzE,+FAA+F;AAC/F,MAAM,OAAO,kBAAmB,SAAQ,iBAAiB;IAC9C,QAAQ,CAAiB;IAElC,YAAY,QAAwB;QAClC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,QAAQ,EAAE,UAAU,EAAE;YACtB,uEAAuE;YACvE,kEAAkE;YAClE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,6EAA6E;SAC9E,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAAiC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,YAAoB,EACpB,QAAgB,EAChB,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,0BAA0B,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY;YACZ,QAAQ;YACR,QAAQ,EAAE,UAAU,EAAE;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,6EAA6E;SAC9E,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,qFAAqF;QACrF,MAAM,OAAO,GAAG,yBAAyB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9E,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAAiC,CAAC;AACnD,CAAC"}

package/dist/pairing-client.d.ts

@@ -1,62 +0,0 @@
-import type { AccountEnrollmentBundle, AccountEnrollmentLink, AccountHistory } from './security/account-protocol.js';
-import type { PendingBridgePairingContext, PendingPairingVerified } from './security/pending-approval-protocol.js';
-/** Servers deny a revoked bridgeId, and trusted browsers refuse to approve it; only a new identity pairs again. */
-export declare const REMOVED_COMPUTER_HINT = "If this computer was removed from your account before, run `ftown start --new-identity`.";
-export interface RunPairingOptions {
-    apiUrl: string;
-    bridgeId: string;
-    hostname: string;
-    platform: string;
-    /**
-     * Loopback WS rung advert embedded so the owning user's clients discover the
-     * loopback rung via presence (matches the auth/refresh path).
-     */
-    localPort: number;
-    /**
-     * Loopback WS rung advert embedded so the owning user's clients discover the
-     * loopback rung via presence (matches the auth/refresh path).
-     */
-    localNonce: string;
-    /** Injectable for tests; defaults to global fetch. */
-    fetchImpl?: typeof fetch;
-    /** Injectable for tests; defaults to a real setTimeout-based sleep. */
-    sleepImpl?: (ms: number) => Promise<void>;
-    /** Where user-facing lines go; defaults to console.log. NEVER receives secrets. */
-    log?: (msg: string) => void;
-    /** The secret remains local; only request is uploaded. */
-    enrollment?: AccountEnrollmentLink;
-    /** Persist public verification metadata in the private pending record. */
-    onPairingCode?: (code: string) => Promise<void>;
-    /** Human-facing TTY ONLY; must never be an operational logger. */
-    displayEnrollmentUrl?: (url: string) => void;
-    /** Explicit pending-v1 mode; never falls back to fragment or auth-only approval. */
-    pending?: PendingBridgePairingContext;
-    accountHint?: string;
-}
-export interface PairingResult {
-    ownerId: string;
-    token: string;
-    refreshToken: string;
-    centrifugoUrl: string;
-    userId: string;
-    accountApproval?: AccountEnrollmentBundle;
-    accountHistory?: AccountHistory;
-    approvalMethod?: 'pending-v1';
-    verifiedAccountTrust?: PendingPairingVerified['verifiedAccountTrust'];
-    lastServerReadAt?: number;
-}
-/**
- * Drive the pairing flow to completion.
- *
- * Resolves with the token bundle on approval; rejects (with a clear, secret-free
- * message) on denial, expiry/consumption/unknown, or overall timeout.
- */
-export declare function runPairing(opts: RunPairingOptions & {
-    pending: PendingBridgePairingContext;
-}): Promise<PendingPairingVerified>;
-export declare function runPairing(opts: RunPairingOptions): Promise<PairingResult>;
-/** Best effort only; the new process always uses a different request and keeps its own key. */
-export declare function cancelPreviousPendingPairing(apiUrl: string, previous: {
-    requestId: string;
-    candidateToken: string;
-}, signal: AbortSignal): Promise<void>;