signalk-siparu 0.1.0 → 0.1.2

package/README.md

@@ -1,7 +1,7 @@
 # Siparu
 
 Kept aboard, proven ashore. A Signal K plugin that records your boat's bridge
-data — position, speed, heading, wind, depth — into an on-board history with
+data - position, speed, heading, wind, depth - into an on-board history with
 voyage detection, and serves it through a built-in dashboard (PWA) and a
 read-only REST API.
 
@@ -9,10 +9,10 @@ read-only REST API.
 
 - **Read-only.** The plugin never writes to your boat: no deltas are emitted,
   no PUT handlers registered, no action handlers, no NMEA out. The CI proves it
-  on every commit — grep this codebase and see for yourself.
+  on every commit - grep this codebase and see for yourself.
 - **Your data stays on board.** History is stored on the boat, in plain NDJSON
   files with hourly/daily summaries. Nothing leaves the vessel unless you pair
-  it, and pairing takes a deliberate tap at the helm — after which the boat
+  it, and pairing takes a deliberate tap at the helm - after which the boat
   sends its current position and name to the portal you paired it with, and
   nothing else. Unpair and it stops. The history never leaves.
 - **Zero runtime dependencies, pure JavaScript.** No native modules, so it
@@ -41,7 +41,7 @@ moves the plugin's own state and never touches the vessel's:
 |---|---|
 | `GET /pair/status` | Current pairing state |
 | `POST /pair/start` | Ask the relay for a code to show at the helm |
-| `POST /pair/approve` · `POST /pair/deny` | Answer a claim — the tap at the helm |
+| `POST /pair/approve` · `POST /pair/deny` | Answer a claim - the tap at the helm |
 | `POST /pair/reset` | Unpair |
 
 Voyage detection opens after sustained movement, closes after sustained

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "signalk-siparu",
-  "version": "0.1.0",
-  "description": "Siparu \u2014 kept aboard, proven ashore. An impartial, timestamped record of every voyage: position, wind, depth and logbook, written on the boat and readable from anywhere. Read-only Signal K plugin with a built-in PWA.",
+  "version": "0.1.2",
+  "description": "Kept aboard, proven ashore. An impartial, timestamped record of every voyage: position, wind, depth and logbook, written on the boat and readable from anywhere. A read-only Signal K plugin with a built-in PWA.",
   "keywords": [
     "signalk-node-server-plugin",
     "signalk-webapp"
@@ -44,4 +44,4 @@
     "typescript": "^5.9.0",
     "vitest": "^4.1.0"
   }
-}
+}

package/plugin/dist/ais.js

@@ -37,7 +37,7 @@ function kn(ms) {
 }
 /**
  * AIS text (name/ship_type/nav_state) renders in map popups. XSS
- * defense-in-depth: strip markup characters server-side too — the frontend
+ * defense-in-depth: strip markup characters server-side too - the frontend
  * escapes as well, this is the second layer.
  */
 function cleanStr(v) {

package/plugin/dist/charts.js

@@ -40,24 +40,29 @@ exports.chartContentType = chartContentType;
 /**
  * Chart asset resolution + safe file serving.
  *
- * The webapp map loads four kinds of assets: a basemap PMTiles, an optional
- * seamark PMTiles, glyph PBFs and a sprite sheet. Each resolves to either a
- * local file under `<dataDir>/charts/` (offline charts, dropped in by the
- * user or a future download feature) or the configured remote tile server.
- * /map-config reports the resolved URLs; the webapp never guesses.
+ * The webapp map loads a basemap, an optional seamark PMTiles, glyph PBFs and a
+ * sprite sheet. Seamarks, glyphs and sprites resolve to either a local file under
+ * `<dataDir>/charts/` (offline charts, dropped in by the user) or the configured
+ * asset server. /map-config reports the resolved URLs; the webapp never guesses.
+ *
+ * The basemap is the odd one out, because its two sources speak different tile
+ * schemas: a local `basemap.pmtiles` is a Protomaps archive, while the hosted
+ * basemap is OpenMapTiles vector tiles behind a TileJSON. They cannot be swapped
+ * for one another, so they get separate fields and exactly one is ever set. Local
+ * wins: charts already on disk cost no bandwidth and survive a dead uplink.
  *
  * Serving stays GET-only and read-only like every other route.
  */
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
-/** URL prefix the server mounts our router on — used for local asset URLs. */
+/** URL prefix the server mounts our router on - used for local asset URLs. */
 const MOUNT = '/plugins/siparu';
 function chartsDir(dataDir) {
     return path.join(dataDir, 'charts');
 }
 /** Resolve every map asset to a local or remote URL. Sync fs is fine here:
  *  called once per /map-config request against at most four stat'ed paths. */
-function resolveMapConfig(dataDir, remoteBaseUrl) {
+function resolveMapConfig(dataDir, remoteBaseUrl, basemapTilesUrl) {
     const dir = chartsDir(dataDir);
     const has = (rel) => {
         try {
@@ -80,7 +85,8 @@ function resolveMapConfig(dataDir, remoteBaseUrl) {
     const localFonts = hasDir('fonts');
     const localSprites = hasDir('sprites');
     return {
-        basemap: localBasemap ? `${MOUNT}/charts/basemap.pmtiles` : `${remoteBaseUrl}/basemap.pmtiles`,
+        basemap: localBasemap ? `${MOUNT}/charts/basemap.pmtiles` : null,
+        basemapTiles: localBasemap ? null : basemapTilesUrl,
         seamark: localSeamark ? `${MOUNT}/charts/seamark.pmtiles` : `${remoteBaseUrl}/seamark.pmtiles`,
         glyphs: localFonts
             ? `${MOUNT}/charts/fonts/{fontstack}/{range}.pbf`

package/plugin/dist/config.js

@@ -3,7 +3,7 @@
  * Plugin configuration: JSON Schema for the Signal K admin UI + resolved
  * runtime options with defaults.
  *
- * Day-1 rule: no boat-specific value may be hardcoded — SOG sanity
+ * Day-1 rule: no boat-specific value may be hardcoded - SOG sanity
  * threshold, TWS source fallback, season start, boat name, optional port
  * table and voyage/tender-merge thresholds are all configuration.
  */
@@ -17,6 +17,7 @@ exports.DEFAULTS = {
     seasonStart: '01-01',
     maxStorageMB: 500,
     chartsRemoteUrl: 'https://tiles.siparu.app',
+    chartsBasemapUrl: 'https://tiles.openfreemap.org/planet',
     relayUrl: 'https://relay.siparu.app',
     ports: [],
     voyage: {
@@ -52,11 +53,14 @@ function resolveOptions(raw) {
         chartsRemoteUrl: /^https?:\/\/\S+$/.test(c.chartsRemoteUrl ?? '')
             ? c.chartsRemoteUrl.replace(/\/+$/, '')
             : exports.DEFAULTS.chartsRemoteUrl,
+        chartsBasemapUrl: /^https?:\/\/\S+$/.test(c.chartsBasemapUrl ?? '')
+            ? c.chartsBasemapUrl.replace(/\/+$/, '')
+            : exports.DEFAULTS.chartsBasemapUrl,
         relayUrl: /^https?:\/\/\S+$/.test(c.relayUrl ?? '')
             ? c.relayUrl.replace(/\/+$/, '')
             : exports.DEFAULTS.relayUrl,
         // Round-trip only. The plugin wrote this; the user never types it, and a
-        // half-formed one is worse than none — a boatToken without a boatId cannot
+        // half-formed one is worse than none - a boatToken without a boatId cannot
         // stream anywhere, it can only confuse the screen into saying "paired".
         remote: c.remote && typeof c.remote.boatId === 'string' && typeof c.remote.boatToken === 'string'
             ? {
@@ -120,10 +124,16 @@ exports.CONFIG_SCHEMA = {
         },
         chartsRemoteUrl: {
             type: 'string',
-            title: 'Chart tile server (advanced)',
-            description: 'Base URL the map loads chart tiles, fonts and sprites from. Files placed in the plugin\'s "charts" data folder are served locally instead (offline charts).',
+            title: 'Seamark and font server (advanced)',
+            description: 'Base URL the map loads seamarks, fonts and sprites from. Files placed in the plugin\'s "charts" data folder are served locally instead (offline charts).',
             default: exports.DEFAULTS.chartsRemoteUrl
         },
+        chartsBasemapUrl: {
+            type: 'string',
+            title: 'Basemap tile server (advanced)',
+            description: 'TileJSON URL for the coastline, land and place names, in OpenMapTiles schema. The default is a free, keyless, planet-wide host; any OpenMapTiles server will do. A basemap.pmtiles in the "charts" data folder overrides this and is used offline.',
+            default: exports.DEFAULTS.chartsBasemapUrl
+        },
         ports: {
             type: 'array',
             title: 'Named ports (optional)',

package/plugin/dist/index.js

@@ -33,14 +33,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 /**
- * Siparu — Signal K plugin entry.
+ * Siparu - Signal K plugin entry.
  *
  * Read-only by contract: this plugin never emits deltas and never issues
  * PUT requests. It subscribes to self paths, records history to
  * NDJSON + materialized rollups, and serves a read-only REST API.
  *
  * Runtime dependencies: none. Types come from @signalk/server-api and
- * express as devDependencies — keep every import from them `import type`,
+ * express as devDependencies - keep every import from them `import type`,
  * a value import would crash on the boat (AppStore installs with
  * --ignore-scripts and without devDependencies).
  */
@@ -56,6 +56,7 @@ const rest_1 = require("./rest");
 const rollup_1 = require("./rollup");
 const store_1 = require("./store");
 const time_1 = require("./time");
+const uplink_1 = require("./uplink");
 const voyagelog_1 = require("./voyagelog");
 const PLUGIN_ID = 'siparu';
 function packageVersion() {
@@ -74,6 +75,7 @@ module.exports = (app) => {
     let rollups = null;
     let query = null;
     let voyages = null;
+    let uplink = null;
     let timer = null;
     let unsubscribes = [];
     // Bumped on every start/stop; a stale async init aborts instead of leaking
@@ -112,7 +114,7 @@ module.exports = (app) => {
         }
         snapshotsToday++;
         const age = state.lastDeltaTs === null ? null : Math.round((now - state.lastDeltaTs) / 1000);
-        app.setPluginStatus(`Recording — ${snapshotsToday} rows today${age === null ? ', no data yet' : age > 60 ? `, data age ${age}s` : ''}`);
+        app.setPluginStatus(`Recording - ${snapshotsToday} rows today${age === null ? ', no data yet' : age > 60 ? `, data age ${age}s` : ''}`);
     }
     async function health() {
         if (!state || !store || !rollups || !query)
@@ -132,7 +134,7 @@ module.exports = (app) => {
             diagnosis: state.diagnose(now, app.getSelfPath('electrical') != null),
             paths: state.pathAges(now),
             storage: {
-                // Absolute data_dir deliberately omitted — it leaks the OS username
+                // Absolute data_dir deliberately omitted - it leaks the OS username
                 // and FS layout to any reader (anonymous when SK security is off).
                 raw_bytes: usage.bytes,
                 cap_bytes: opts.maxStorageMB * 1024 * 1024,
@@ -155,7 +157,7 @@ module.exports = (app) => {
     const plugin = {
         id: PLUGIN_ID,
         name: 'Siparu',
-        description: 'Kept aboard, proven ashore — records position, wind, depth and voyage history on the boat and serves a read-only dashboard. Never writes to the boat.',
+        description: 'Kept aboard, proven ashore: records position, wind, depth and voyage history on the boat and serves a read-only dashboard. Never writes to the boat.',
         schema: config_1.CONFIG_SCHEMA,
         start(config) {
             const gen = ++startGen;
@@ -228,10 +230,24 @@ module.exports = (app) => {
                     rollupHours: async (from, to) => ({
                         rows: await ru.readHourly(from, to)
                     }),
-                    mapConfig: () => (0, charts_1.resolveMapConfig)(app.getDataDirPath(), opts.chartsRemoteUrl),
+                    mapConfig: () => (0, charts_1.resolveMapConfig)(app.getDataDirPath(), opts.chartsRemoteUrl, opts.chartsBasemapUrl),
                     dataDir: () => app.getDataDirPath()
                 });
-                app.setPluginStatus('Recording — waiting for first snapshot');
+                // Ashore. Only started once the vessel's own recording is up, because that is
+                // the order of the promises: her history is hers whether or not anyone ever
+                // pays for the remote half, and it must not wait on a network to begin.
+                //
+                // Started even when she is not paired - it sends nothing until she is, and it
+                // means pairing her mid-passage starts the feed without a restart.
+                const up = new uplink_1.Uplink({
+                    relayUrl: opts.relayUrl,
+                    getRemote: () => opts.remote,
+                    frame: () => live(),
+                    debug: (msg) => app.debug(msg)
+                });
+                uplink = up;
+                up.start();
+                app.setPluginStatus('Recording - waiting for first snapshot');
             })
                 .catch((err) => {
                 app.setPluginError(`start failed: ${err}`);
@@ -253,6 +269,7 @@ module.exports = (app) => {
             });
             unsubscribes = [];
             (0, rest_1.setRestDeps)(null);
+            uplink?.stop();
             if (voyages)
                 await voyages.flush();
             if (store)
@@ -262,18 +279,25 @@ module.exports = (app) => {
             rollups = null;
             query = null;
             voyages = null;
+            uplink = null;
             app.setPluginStatus('Stopped');
         },
         registerWithRouter(router) {
             (0, rest_1.registerRoutes)(router);
-            // Pairing keeps its own routes. rest.ts is GET-only on purpose — that is part
-            // of how "never writes" is proved — and pairing needs POST. It writes nothing
+            // Pairing keeps its own routes. rest.ts is GET-only on purpose - that is part
+            // of how "never writes" is proved - and pairing needs POST. It writes nothing
             // to Signal K either way: it calls the relay outbound and saves the plugin's
             // own options.
             (0, pairing_1.registerPairRoutes)(router, {
                 app,
                 relayUrl: opts?.relayUrl ?? config_1.DEFAULTS.relayUrl,
                 boatName: () => opts?.boatName || String(app.getSelfPath('name') ?? ''),
+                uplinkStatus: () => uplink?.status() ?? null,
+                // The vessel's MMSI or UUID urn. Typed as a plain string, but the server only
+                // assigns it when the boat has one or the other, so at runtime it can be
+                // undefined - which is fine, because nothing is authorised by it: it is reported
+                // for identification, never used to prove who she is.
+                vesselUrn: () => String(app.selfId ?? ''),
                 getRemote: () => opts?.remote,
                 saveRemote: async (remote) => {
                     // savePluginOptions persists through plugin updates (the plan requires
@@ -284,6 +308,10 @@ module.exports = (app) => {
                         app.savePluginOptions(next, (err) => err ? reject(err instanceof Error ? err : new Error(String(err))) : resolve());
                     });
                     opts = next;
+                    // A new link is not answerable for the old one's failures: an unlink followed
+                    // by a fresh pairing must not leave "rejected" on the screen of a boat that is
+                    // now streaming perfectly well.
+                    uplink?.reset();
                 }
             });
         }

package/plugin/dist/metrics.js

@@ -96,7 +96,7 @@ class MetricsState {
         bySource.set(key, { value: stored, ts, emaIntervalMs });
         this.lastDeltaTs = ts;
         // Gust max-hold: remember the highest true wind speed seen since the
-        // last snapshot flush — but only samples from the currently winning
+        // last snapshot flush - but only samples from the currently winning
         // TWS path+source, so a stale second anemometer can't inflate gusts.
         if (TWS_SET.has(path)) {
             const active = this.resolveConcept(TWS_PATHS, ts);
@@ -244,7 +244,7 @@ class MetricsState {
         if (now - this.lastDeltaTs > config_1.INTERNAL.degradedAfterMs) {
             return {
                 code: 'instruments-off',
-                message: 'Instruments have been silent for a while — normal if the boat is shut down.',
+                message: 'Instruments have been silent for a while - normal if the boat is shut down.',
                 since_ts: this.lastDeltaTs
             };
         }

package/plugin/dist/pairing.js

@@ -1,29 +1,52 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.RelayRefused = void 0;
 exports.maskEmail = maskEmail;
 exports.registerPairRoutes = registerPairRoutes;
 exports.__resetPairingState = __resetPairingState;
 /**
  * The device_code lives in memory only. If Signal K restarts mid-pairing the code
- * is lost and the skipper asks for a new one — which is correct: a secret that
+ * is lost and the skipper asks for a new one - which is correct: a secret that
  * outlives the screen showing it is a secret waiting to be found in a config file.
  */
 let deviceCode = null;
 let userCode = null;
 let expiresAt = null;
 let lastError = null;
-async function relay(url, path, body) {
+/** A relay that answered and said no. Distinct from one that never answered at all. */
+class RelayRefused extends Error {
+    status;
+    code;
+    constructor(status, 
+    /** The relay's machine-readable reason, when it gave one ("not_your_boat"). */
+    code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'RelayRefused';
+    }
+}
+exports.RelayRefused = RelayRefused;
+/**
+ * `boatToken` is the boat proving she is who she says she is. The relay will only let
+ * a re-pairing land on an existing vessel when this is present and valid - an identity
+ * she merely asserts (her MMSI) is public information and proves nothing.
+ */
+async function relay(url, path, body, boatToken) {
     let res;
     try {
         res = await fetch(`${url}${path}`, {
             method: 'POST',
-            headers: { 'content-type': 'application/json' },
+            headers: {
+                'content-type': 'application/json',
+                ...(boatToken ? { authorization: `Bearer ${boatToken}` } : {})
+            },
             body: JSON.stringify(body)
         });
     }
     catch (e) {
-        // fetch() throws a bare "TypeError: fetch failed" and buries the actual reason —
-        // DNS, TLS, a captive portal, a dead uplink — in .cause. On a boat that reason IS
+        // fetch() throws a bare "TypeError: fetch failed" and buries the actual reason -
+        // DNS, TLS, a captive portal, a dead uplink - in .cause. On a boat that reason IS
         // the diagnosis, and a log line that omits it sends the owner looking at the wrong
         // thing. Carry it up.
         const cause = e instanceof Error && e.cause ? `: ${String(e.cause)}` : '';
@@ -31,11 +54,24 @@ async function relay(url, path, body) {
     }
     if (!res.ok) {
         const text = await res.text().catch(() => '');
-        throw new Error(`relay ${path} -> ${res.status} ${text.slice(0, 120)}`);
+        let code = null;
+        try {
+            code = JSON.parse(text).error ?? null;
+        }
+        catch {
+            // Not every refusal is JSON (a proxy, a captive portal, a 502 from the edge).
+        }
+        // A refusal is not an outage, and telling them apart is the whole point of the
+        // message the skipper reads next. The relay rejecting a request means the boat's
+        // uplink WORKS - sending them to look at DNS and captive portals is a wrong
+        // diagnosis dressed up as a helpful one.
+        throw new RelayRefused(res.status, code, `relay ${path} -> ${res.status} ${text.slice(0, 120)}`);
     }
     return (await res.json());
 }
-/** o***@gmail.com — enough for the owner to recognise themselves, not enough to harvest. */
+/** The relay refused because the claimant does not own the boat she is already linked to. */
+const NOT_YOUR_BOAT = 'That account does not own this boat. She is still linked as before.';
+/** o***@gmail.com - enough for the owner to recognise themselves, not enough to harvest. */
 function maskEmail(email) {
     if (!email)
         return null;
@@ -45,25 +81,30 @@ function maskEmail(email) {
     return `${email[0]}***${email.slice(at)}`;
 }
 function registerPairRoutes(router, deps) {
-    const { app, relayUrl, boatName, getRemote, saveRemote } = deps;
+    const { app, relayUrl, boatName, vesselUrn, getRemote, saveRemote, uplinkStatus } = deps;
+    const paired = (remote) => ({
+        state: 'paired',
+        boatId: remote.boatId,
+        email: remote.pairedEmail,
+        pairedAt: remote.pairedAt,
+        uplink: uplinkStatus() ?? undefined
+    });
     /** What the on-board screen renders. Safe to poll; never returns a secret. */
     router.get('/pair/status', (_req, res) => {
         void (async () => {
             const remote = getRemote();
-            if (remote) {
-                res.json({
-                    state: 'paired',
-                    boatId: remote.boatId,
-                    email: remote.pairedEmail,
-                    pairedAt: remote.pairedAt
-                });
-                return;
-            }
-            if (lastError) {
-                res.json({ state: 'error', message: lastError });
-                return;
-            }
-            if (!deviceCode || !userCode || !expiresAt) {
+            // A pairing in progress outranks "paired": an already-linked boat can be
+            // re-paired, and during that the screen must show the new code. Reporting her as
+            // paired would hide the very thing the skipper is standing there to read.
+            if (deviceCode === null || userCode === null || expiresAt === null) {
+                if (remote) {
+                    res.json(paired(remote));
+                    return;
+                }
+                if (lastError) {
+                    res.json({ state: 'error', message: lastError });
+                    return;
+                }
                 res.json({ state: 'idle' });
                 return;
             }
@@ -101,26 +142,40 @@ function registerPairRoutes(router, deps) {
             }
         })();
     });
-    /** "Turn on remote viewing" — asks the relay for a code to put on the screen. */
+    /**
+     * "Turn on remote viewing", and equally "re-pair her".
+     *
+     * An already-paired boat may start a new pairing without unlinking first, and she
+     * SHOULD: the token she is holding travels with this request, and it is the only
+     * thing that lets the relay put the new pairing back on the vessel that already
+     * exists. Making her unlink first would throw that proof away, and every reinstall
+     * would leave the owner another dead duplicate in her fleet.
+     */
     router.post('/pair/start', (_req, res) => {
         void (async () => {
-            if (getRemote()) {
-                res.status(409).json({ error: 'already_paired' });
-                return;
-            }
             lastError = null;
             try {
-                const started = await relay(relayUrl, '/pair/start', { boat_name: boatName() || null });
+                const started = await relay(relayUrl, '/pair/start', {
+                    boat_name: boatName() || null,
+                    vessel_urn: vesselUrn() || null
+                }, getRemote()?.boatToken);
                 deviceCode = started.device_code;
                 userCode = started.user_code;
                 expiresAt = new Date(Date.now() + started.expires_in * 1000).toISOString();
                 res.json({ state: 'showing_code', userCode, expiresAt });
             }
             catch (e) {
-                // No code is generated at all if the relay cannot be reached — the plan is
+                // No code is generated at all if the relay cannot be reached - the plan is
                 // explicit about this. A code the owner can type but the boat can never
                 // confirm is worse than an honest error.
-                lastError = 'Cannot reach Siparu. Check the boat is online (DNS, port 443, captive portal).';
+                lastError =
+                    e instanceof RelayRefused && e.status === 429
+                        ? // The relay counts per IP, not per boat, and a boat on Starlink or marina
+                            // wifi shares hers with everyone else behind the same CGNAT. Blaming the
+                            // vessel for a neighbour's attempts would send the skipper hunting a fault
+                            // that is not there.
+                            'Too many pairing attempts from this network. Wait an hour and try again.'
+                        : 'Cannot reach Siparu. Check the boat is online (DNS, port 443, captive portal).';
                 app.error(`pair start failed: ${String(e)}`);
                 res.status(502).json({ state: 'error', message: lastError });
             }
@@ -137,9 +192,22 @@ function registerPairRoutes(router, deps) {
                 return;
             }
             try {
+                const previous = getRemote();
                 const done = await relay(relayUrl, '/pair/approve', { device_code: deviceCode });
+                // She is already linked, and this approval points somewhere else. That means the
+                // account which typed the code does not own her, so the relay opened a boat of
+                // ITS own. Adopting it would aim this vessel's feed at a stranger's account and
+                // leave the real owner's boat dark - the hijack, arriving by the back door, in a
+                // response the boat asked for. The relay refuses this too; the boat refuses it
+                // again, because a plugin that trusts whatever comes back has no defence at all.
+                if (previous && done.boat_id !== previous.boatId) {
+                    deviceCode = userCode = expiresAt = null;
+                    app.error(`pair approve returned a different boat (${done.boat_id}); refusing`);
+                    res.status(409).json({ state: 'error', message: NOT_YOUR_BOAT });
+                    return;
+                }
                 // Persist BEFORE reporting success. If the disk is full (Cerbo issue #46 is
-                // real and filed) this throws, and the owner is told pairing failed — rather
+                // real and filed) this throws, and the owner is told pairing failed - rather
                 // than being told they are paired while the token quietly evaporates on the
                 // next restart.
                 await saveRemote({
@@ -148,14 +216,30 @@ function registerPairRoutes(router, deps) {
                     pairedEmail: maskEmail(done.claimed_by_email),
                     pairedAt: new Date().toISOString()
                 });
+                // The new token is on disk, so the one it replaces may now be retired. This is
+                // the only reason the relay left the old token alive at all: had it killed the
+                // old one at approval and the write above failed, the boat would be off the air
+                // holding a token she never managed to keep. Best effort - if it does not get
+                // through, the previous token simply lives a little longer, which is harmless
+                // and self-corrects on the next re-pairing.
+                await relay(relayUrl, '/pair/confirm', {}, done.boat_token).catch((e) => {
+                    app.debug(`pair confirm failed, old token still live: ${String(e)}`);
+                });
                 deviceCode = userCode = expiresAt = null;
                 res.json({ state: 'paired', boatId: done.boat_id });
             }
             catch (e) {
                 app.error(`pair approve failed: ${String(e)}`);
-                res.status(502).json({
+                // The relay refuses a re-pairing claimed by anyone who does not already own her,
+                // and that is not a fault to retry - it is an answer. Telling the skipper to try
+                // again would have them hammering a code that can never work, while the real
+                // cause (they typed it into the wrong account) goes unsaid.
+                const denied = e instanceof RelayRefused && e.code === 'not_your_boat';
+                if (denied)
+                    deviceCode = userCode = expiresAt = null;
+                res.status(denied ? 409 : 502).json({
                     state: 'error',
-                    message: 'Could not finish pairing. Try again.'
+                    message: denied ? NOT_YOUR_BOAT : 'Could not finish pairing. Try again.'
                 });
             }
         })();
@@ -166,7 +250,10 @@ function registerPairRoutes(router, deps) {
                 await relay(relayUrl, '/pair/deny', { device_code: deviceCode }).catch(() => { });
             }
             deviceCode = userCode = expiresAt = null;
-            res.json({ state: 'idle' });
+            // Refusing a re-pairing leaves the boat exactly as she was: still linked, still
+            // streaming, on the token she already holds. Only an unlink changes that.
+            const remote = getRemote();
+            res.json(remote ? paired(remote) : { state: 'idle' });
         })();
     });
     /**
@@ -174,11 +261,22 @@ function registerPairRoutes(router, deps) {
      *
      * This is the GDPR-critical one, and the plan says so: a boat changes hands, and
      * the previous owner must not keep watching her. Cutting from the vessel's own
-     * screen — no portal, no account, just Signal K admin access — is the half of
+     * screen - no portal, no account, just Signal K admin access - is the half of
      * that which the new owner actually controls.
      */
     router.post('/pair/reset', (_req, res) => {
         void (async () => {
+            const remote = getRemote();
+            // Forgetting the token here is not enough - it would go on working at the relay,
+            // and anyone holding a copy (an old disk image, a plotter sold with the boat)
+            // could still write to this vessel. Tell the relay to kill it, THEN forget it.
+            // Best effort: if the boat is offline the local link is still cut, which is what
+            // the person standing at the screen asked for.
+            if (remote?.boatToken) {
+                await relay(relayUrl, '/pair/unlink', {}, remote.boatToken).catch((e) => {
+                    app.error(`unlink could not reach the relay, token still live there: ${String(e)}`);
+                });
+            }
             await saveRemote(undefined);
             deviceCode = userCode = expiresAt = null;
             lastError = null;

package/plugin/dist/query.js

@@ -100,7 +100,7 @@ class QueryService {
         }
         return out;
     }
-    /** Rows recorded today (UTC) — used by /health. */
+    /** Rows recorded today (UTC) - used by /health. */
     async countToday(now) {
         const today = (0, time_1.dayKey)(now);
         const keys = (await this.store.listRawKeys()).filter((k) => k.startsWith(today));

package/plugin/dist/rest.js

@@ -38,7 +38,7 @@ exports.registerRoutes = registerRoutes;
 /**
  * Read-only REST API, mounted by the server at /plugins/siparu/.
  *
- * GET-only by construction — this file is the only place routes are
+ * GET-only by construction - this file is the only place routes are
  * registered, and it registers nothing but router.get(). "Never writes to
  * the boat" is a sales claim backed by grep.
  */
@@ -141,17 +141,17 @@ function registerRoutes(router) {
         return d.voyageTrack(id);
     });
     asyncGet('/ais/targets', (d, req) => d.aisTargets(intParam(req, 'max_nm'), intParam(req, 'max_age_min'), intParam(req, 'limit')));
-    // Raw hourly rollup lines — the webapp derives history series (baro,
+    // Raw hourly rollup lines - the webapp derives history series (baro,
     // gust peaks, coarse tracks) from these instead of scanning raw files.
     asyncGet('/rollups/hourly', (d, req) => {
         const from = intParam(req, 'from') ?? 0;
         const to = intParam(req, 'to') ?? Date.now();
         return d.rollupHours(from, to);
     });
-    // Resolved chart asset URLs (local charts folder vs remote tile server) —
+    // Resolved chart asset URLs (local charts folder vs remote tile server) -
     // the webapp asks instead of guessing, so offline charts "just work".
     asyncGet('/map-config', async (d) => d.mapConfig());
-    // Local chart assets (PMTiles/glyphs/sprites) with HTTP Range support —
+    // Local chart assets (PMTiles/glyphs/sprites) with HTTP Range support -
     // express sendFile answers 206s, which is how PMTiles clients read.
     router.get('/charts/*', (req, res) => {
         if (!deps)
@@ -166,7 +166,7 @@ function registerRoutes(router) {
         if (explicitType)
             res.type(explicitType);
         // root + relative path: dotfile denial must only apply to segments
-        // BELOW the charts dir — the data dir itself usually lives under a
+        // BELOW the charts dir - the data dir itself usually lives under a
         // dot directory (~/.signalk) and an absolute path would 403.
         res.sendFile(nodePath.relative(dir, abs), { root: dir, dotfiles: 'deny', cacheControl: true, maxAge: '1h' }, (err) => {
             if (!err || res.headersSent)

package/plugin/dist/rollup.js

@@ -83,7 +83,7 @@ const LAST_ONLY_FIELDS = [
 ];
 /**
  * Clamp a query window to [epoch, now]. No data exists before 1970 or in the
- * future, so this narrows nothing legitimate — but it stops a hostile
+ * future, so this narrows nothing legitimate - but it stops a hostile
  * `?to=8640000000000000` from walking millions of month/year buckets and
  * freezing the single Node event loop the whole Signal K server shares.
  * Applied at the read sink so every caller (REST, voyage replay) is covered.