teamclaws 1.0.4 → 2.0.1

package/README.md

@@ -43,6 +43,34 @@ live hosting. Login and pairing mechanics remain in their respective skills;
 [teamclaws-project](skills/teamclaws-project/SKILL.md) covers project work through
 the existing paired shell. Status-only requests do not start onboarding.
 
+Before any browser authorization, the agent explains the process: sign this
+computer's CLI into the user's TeamClaws account through the browser, choose a
+workspace and approve pairing with that server in the browser, then choose useful
+work and set up its environment on the server. It explains the purpose and access
+of each approval before presenting a link, adapting to steps already completed.
+The conversation starts with that context rather than an unexplained request to
+click an authorization link.
+
+Agents keep their turn and the original login/pairing process alive while the
+user approves in the browser, monitor its output, and continue automatically
+after terminal success. No "I approved" message is needed. An execution
+environment that must yield needs a supported completion callback or automatic
+wakeup that preserves the process; a saved skill alone cannot supply that
+runtime capability.
+
+After verified pairing, the agent refreshes `teamclaws servers list --json` and
+presents each workspace's name, description, and readiness in a Markdown list or
+code block, or plain text with one option per line. It then suggests concrete
+uses tied to the user's work and continues an already authorized task. An
+explicit request to stop at pairing takes precedence. Pairing and status-only
+requests never implicitly authorize deployment, sharing, or a remote chat.
+
+The bundled [workspace capability guide](skills/teamclaws-onboard/references/workspace-uses.md)
+explains complete jobs, long-running services, external APIs and servers, agents
+with browser access, development and production hosting, and sharing. Agents
+should use it to propose relevant work in the user's vocabulary and verify each
+selected host's prerequisites before promising a capability is ready.
+
 ### Onboarding output contract
 
 Existing event names and schema version remain unchanged. The
@@ -51,6 +79,36 @@ Existing event names and schema version remain unchanged. The
 login keeps running. Signed-out `auth_status` includes the non-executing
 `login_command: "teamclaws login --json"`; status never starts device authorization.
 
+`pairing_browser_required` supplies the safe approval URL and public `user_code`.
+Some hosts include a validated `agent_action` with the legacy type
+`deliver_and_stop`. The agent displays its approval message and continues
+monitoring the original process; that field does not end the agent's turn. The
+CLI directly polls at the host-provided interval, handles pending and slow-down
+responses, and verifies the approved credential before `pairing_complete`.
+Success requires that terminal event and exit 0. Denial, expiry, cancellation,
+and errors end the attempt without automatic restart. An interrupted output
+stream leaves the outcome unconfirmed and must be reconciled before retrying.
+
+### Approval continuation verification
+
+The development tests exercise pending approval, automatic credential completion,
+denial, expiry, cancellation, and a referenced polling timer. The delayed
+approval process test runs the compiled pairing client with stdin disconnected:
+a fixture simulates the owner's later browser approval, and the same child
+process must emit exactly one `pairing_complete` and exit 0 without a chat reply.
+Package validation also checks that the capability reference ships with the
+skills and matches the source bytes by SHA-256.
+
+For acceptance in an agent environment, load the updated bundled skills, select
+an authorized test workspace, and start pairing. Confirm the approval link is
+visible while the turn stays active. Approve in the browser without sending a
+chat message. The agent must observe terminal success, refresh and format the
+workspace inventory, and continue the authorized task or suggest a relevant next
+action. Repeat denial and expiry to confirm it stops without creating another
+request. Test a required-yield environment separately if automatic wakeup is
+used. Local CLI tests establish process behavior, not automatic loading or
+compliance in every agent environment.
+
 `servers list` requests `GET /api/cli/v1/servers/?include_inventory=1&include_description=1&include_editable_metadata=1`. Updated
 brokers return `servers` and `workspace_count`: the count of all non-deleted
 owned and eligible shared workspaces, including those without a hostname yet.
@@ -71,6 +129,14 @@ purchase a workspace. Existing owners whose machines are being prepared do not
 need another purchase. Targetless pairing requires explicit selection even for
 one result; agents present aliases and pass only user-selected stable IDs.
 
+During onboarding or the post-pairing inventory, agents suggest a recognizable
+name for the selected editable workspace if its displayed alias matches
+`workspace-` followed by 12 lowercase hexadecimal characters, such as
+`workspace-07d9e4893885`. Suggestions should reflect the user's project or intended
+use and wait for their choice before renaming. A customized display name is kept
+even when its hostname still follows that pattern. Combine this suggestion with
+any metadata prompt already being shown rather than asking twice.
+
 Owners can edit their server's user-defined name and description:
 
 ```text
@@ -100,6 +166,7 @@ npx teamclaws login
 npx teamclaws login <email>
 npx teamclaws auth status
 npx teamclaws logout
+npx teamclaws logout --revoke
 npx teamclaws servers list
 npx teamclaws pair status <server-identifier-or-canonical-workspace-address>
 npx teamclaws pair
@@ -114,11 +181,14 @@ Human-readable output is the default. Add `--json` for the strict, versioned,
 newline-delimited JSON event stream intended for automation.
 
 Pairing (including explicit targets), server listing, pair status, chat, and shell
-require a valid TeamClaws CLI account login. Run `teamclaws login` first. The CLI
-refreshes and verifies that login before contacting the workspace or requesting
-pairing approval. Missing or invalid authentication exits with code 3 in both
-human and JSON modes. Help, version, login, auth status, and logout remain
-available. Saved workspace credentials are preserved when login is required.
+require a saved TeamClaws CLI authorization and its local machine key. Run
+`teamclaws login` first. Login uses the browser approval to bind a new key to
+your TeamClaws account; the CLI discards the temporary OAuth tokens. Later
+commands sign fresh proofs without repeating browser approval. Missing or
+revoked authorization exits with code 3 in both human and JSON modes. Help,
+version, login, auth status, and logout remain available. Saved workspace
+credentials are preserved when login is required, but pairings made before this
+authorization protocol must be paired again.
 
 Pairing is broad privileged delegation to the approved workspace. The client
 does not request or select scopes, profiles, capability bundles, roles, user
@@ -129,10 +199,10 @@ The client never accepts a model or harness access token. An agent that already
 discovered a workspace passes only the selected stable server identifier to the
 `pair` command.
 
-After account authentication, `pair status` reads the matching protected local
-workspace credential, performs at most one direct workspace verification with a
-five-second timeout, reports the result, and stops. It never starts pairing or
-loads external-chat resources.
+`pair status` reads the matching protected local workspace credential, obtains
+a short-lived target proof for that bound pairing, performs at most one direct
+workspace verification with a five-second timeout, reports the result, and
+stops. It never starts pairing or loads external-chat resources.
 
 After pairing, `chat start`, `chat send`, and `chat watch` use the protected
 workspace credential directly against that exact workspace. They verify the
@@ -145,6 +215,12 @@ monitoring without creating another turn.
 
 ## Host shell commands
 
+For authorized workspace administration, first check pairing status with
+`teamclaws pair status <target> --json`. If `not_paired`, complete CLI login and pairing
+approval for that workspace before using the shell. A linked AI provider or
+TCChat conversation is not required for paired-shell access; remote chat is a
+separate operation.
+
 `teamclaws shell <target> --command <text> [--json]` uses an existing saved
 pairing to execute the exact command text on the workspace host. Quote the
 command as one local shell argument; quotes, pipes and newlines inside that
@@ -164,12 +240,16 @@ execution outcome unknown; inspect the host before deciding to run it again.
 
 ## Local storage
 
-Login credentials are stored in the private TeamClaws user directory. Completed
-workspace credentials are stored by stable server identifier beneath
+The CLI stores the approved authorization ID, account ID, and public key
+reference in its private user directory. The private signing key remains in
+Windows CNG or, on Linux and macOS, a separate protected PKCS#8 key file.
+Completed workspace credentials are stored by stable server identifier beneath
 `~/.teamclaws/clawgate-devices/<server-uuid>.json`. Writes are atomic. Unix
 directories use mode `0700` and files use mode `0600`; Windows uses
 inheritance-disabled access-control entries limited to the current user and the
-Windows system account.
+Windows system account. Ordinary `logout` removes local authorization access;
+`logout --revoke` waits for TeamClaws to confirm server-side revocation before
+removing the local reference. Neither command deletes saved pairings.
 
 The package is licensed under the PolyForm Shield License 1.0.0. Paid service
 access is enforced by TeamClaws servers, not by the client license.

package/dist/app.js

@@ -8,6 +8,7 @@ import { Output } from "./output.js";
 import { PairingClient } from "./pairing.js";
 import { runShell, shellFetch } from "./shell.js";
 import { CredentialStore } from "./storage.js";
+import { TargetAuthorization } from "./target-authorization.js";
 import { installRelease } from "./update.js";
 import { normalizeUuid, parsePairingTarget } from "./validation.js";
 export async function run(arguments_, dependencies = {}, signal) {
@@ -68,6 +69,7 @@ export async function run(arguments_, dependencies = {}, signal) {
         return code;
     }
     const store = dependencies.store ?? new CredentialStore();
+    const targetAuthorization = new TargetAuthorization(store, dependencies.fetcher);
     const auth = new AuthService({
         store,
         output,
@@ -77,9 +79,11 @@ export async function run(arguments_, dependencies = {}, signal) {
             : {}),
     });
     const broker = new BrokerClient({
+        authorization: targetAuthorization,
         ...(dependencies.fetcher ? { fetcher: dependencies.fetcher } : {}),
     });
     const pairing = new PairingClient({
+        authorization: targetAuthorization,
         store,
         output,
         ...(dependencies.fetcher ? { fetcher: dependencies.fetcher } : {}),
@@ -88,6 +92,7 @@ export async function run(arguments_, dependencies = {}, signal) {
             : {}),
     });
     const externalChat = new ExternalChatClient({
+        authorization: targetAuthorization,
         store,
         output,
         ...(dependencies.fetcher ? { fetcher: dependencies.fetcher } : {}),
@@ -101,15 +106,13 @@ export async function run(arguments_, dependencies = {}, signal) {
                 await auth.status(signal);
                 return 0;
             case "logout":
-                await auth.logout(signal);
+                await auth.logout(signal, parsed.revoke);
                 return 0;
         }
-        const token = await auth.requireAccessToken(parsed.action === "pair"
-            ? "Authenticate in the TeamClaws CLI with `teamclaws login` before making a pairing request."
-            : "Authenticate in the TeamClaws CLI with `teamclaws login` before running this command.", signal);
+        await targetAuthorization.requireGrant();
         switch (parsed.action) {
             case "shell": {
-                const result = await runShell(store, dependencies.fetcher ?? shellFetch, parsePairingTarget(parsed.target), parsed.command, signal);
+                const result = await runShell(store, dependencies.fetcher ?? shellFetch, parsePairingTarget(parsed.target), parsed.command, targetAuthorization, signal);
                 if (parsed.json)
                     stdout.write(`${JSON.stringify(result)}\n`);
                 else {
@@ -119,21 +122,21 @@ export async function run(arguments_, dependencies = {}, signal) {
                 return result.exit_code;
             }
             case "servers_list": {
-                const inventory = await broker.servers(token, signal);
-                await offerServerMetadata(inventory.servers, broker, token, parsed.json, output, dependencies.io, signal);
+                const inventory = await broker.servers(signal);
+                await offerServerMetadata(inventory.servers, broker, parsed.json, output, dependencies.io, signal);
                 output.servers(inventory.servers, inventory.workspace_count);
                 return 0;
             }
             case "servers_update": {
-                const server = await broker.updateServerMetadata(token, parsed.serverId, parsed.updates, signal);
+                const server = await broker.updateServerMetadata(parsed.serverId, parsed.updates, signal);
                 output.serverMetadataUpdated(server);
                 return 0;
             }
             case "pair": {
                 const target = parsed.target
                     ? parsePairingTarget(parsed.target)
-                    : await discoverTarget(broker, token, parsed.json, output, dependencies.io, signal);
-                const pending = await broker.startPairing(target, token, signal);
+                    : await discoverTarget(broker, parsed.json, output, dependencies.io, signal);
+                const pending = await broker.startPairing(target, signal);
                 await pairing.complete(pending, broker.currentDeviceName(), parsed.noOpen, signal);
                 return 0;
             }
@@ -224,8 +227,9 @@ export function parseArguments(arguments_) {
         }
         throw usageError();
     }
-    if (args[0] === "logout" && args.length === 1)
-        return { action: "logout", json };
+    if (args[0] === "logout" &&
+        (args.length === 1 || (args.length === 2 && args[1] === "--revoke")))
+        return { action: "logout", json, revoke: args.length === 2 };
     if (args[0] === "auth" && args[1] === "status" && args.length === 2) {
         return { action: "auth_status", json };
     }
@@ -382,9 +386,9 @@ function nonNegativeInteger(value) {
         throw usageError();
     return parsed;
 }
-async function discoverTarget(broker, token, json, output, io, signal) {
-    const inventory = await broker.servers(token, signal);
-    await offerServerMetadata(inventory.servers, broker, token, json, output, io, signal);
+async function discoverTarget(broker, json, output, io, signal) {
+    const inventory = await broker.servers(signal);
+    await offerServerMetadata(inventory.servers, broker, json, output, io, signal);
     const servers = inventory.servers.filter((server) => server.pairing_ready);
     if (servers.length === 0) {
         throw new TeamClawsError("no_pairing_ready_workspaces", inventory.workspace_count === 0
@@ -399,7 +403,7 @@ async function discoverTarget(broker, token, json, output, io, signal) {
     const selected = await promptForServer(servers, io?.input ?? process.stdin, io?.stdout ?? process.stdout);
     return { server_id: selected.server_id };
 }
-async function offerServerMetadata(servers, broker, token, json, output, io, signal) {
+async function offerServerMetadata(servers, broker, json, output, io, signal) {
     const interactive = io?.interactive ?? (process.stdin.isTTY && process.stdout.isTTY);
     if (!json && !interactive)
         return;
@@ -409,7 +413,7 @@ async function offerServerMetadata(servers, broker, token, json, output, io, sig
             server.description === undefined ||
             (server.custom_alias.trim() !== "" && server.description.trim() !== ""))
             continue;
-        const claimed = await broker.claimMetadataPrompt(token, server.server_id, signal);
+        const claimed = await broker.claimMetadataPrompt(server.server_id, signal);
         Object.assign(server, claimed.server);
         if (!claimed.should_prompt)
             continue;
@@ -432,7 +436,7 @@ async function offerServerMetadata(servers, broker, token, json, output, io, sig
             if (description.trim())
                 updates.description = description;
             if (Object.keys(updates).length > 0) {
-                const updated = await broker.updateServerMetadata(token, server.server_id, updates, signal);
+                const updated = await broker.updateServerMetadata(server.server_id, updates, signal);
                 Object.assign(server, updated);
                 output.serverMetadataUpdated(updated);
             }
@@ -467,5 +471,5 @@ function usageError() {
     });
 }
 export function helpText() {
-    return `TeamClaws ${PACKAGE_VERSION}\n\nUsage:\n  teamclaws update [--json]\n  teamclaws shell <target> --command <text> [--json]\n  teamclaws login [email] [--json]\n  teamclaws auth status [--json]\n  teamclaws logout [--json]\n  teamclaws servers list [--json]\n  teamclaws servers update <server-id> [--name <text>] [--description <text>] [--json]\n  teamclaws pair status <server-identifier-or-canonical-workspace-address> [--json]\n  teamclaws pair [server-identifier-or-canonical-workspace-address] [--no-open] [--json]\n  teamclaws chat list <target> [--json]\n  teamclaws chat capabilities <target> [--json]\n  teamclaws chat start <target> --message <text> [selection options] [--json]\n  teamclaws chat send <target> --session-id <uuid> --message <text> [--json]\n  teamclaws chat watch <target> --session-id <uuid> --request-id <uuid> [resume cursors] [--json]\n\nPair status performs one bounded direct verification and stops. Pairing grants the standard host-issued credential. Chat commands use that credential directly against the selected workspace.\n`;
+    return `TeamClaws ${PACKAGE_VERSION}\n\nUsage:\n  teamclaws update [--json]\n  teamclaws shell <target> --command <text> [--json]\n  teamclaws login [email] [--json]\n  teamclaws auth status [--json]\n  teamclaws logout [--revoke] [--json]\n  teamclaws servers list [--json]\n  teamclaws servers update <server-id> [--name <text>] [--description <text>] [--json]\n  teamclaws pair status <server-identifier-or-canonical-workspace-address> [--json]\n  teamclaws pair [server-identifier-or-canonical-workspace-address] [--no-open] [--json]\n  teamclaws chat list <target> [--json]\n  teamclaws chat capabilities <target> [--json]\n  teamclaws chat start <target> --message <text> [selection options] [--json]\n  teamclaws chat send <target> --session-id <uuid> --message <text> [--json]\n  teamclaws chat watch <target> --session-id <uuid> --request-id <uuid> [resume cursors] [--json]\n\nPair status performs one bounded direct verification and stops. Pairing grants the standard host-issued credential. Chat commands use that credential directly against the selected workspace.\n`;
 }

package/dist/auth.js

@@ -1,8 +1,10 @@
-import { ACCESS_TOKEN_MAX_LIFETIME_SECONDS, API_BASE, API_RESOURCE, OAUTH_CLIENT_ID, OAUTH_DEVICE_AUTHORIZATION_URL, OAUTH_LOGIN_TIMEOUT_MS, OAUTH_REVOKE_URL, OAUTH_TOKEN_URL, TEAMCLAWS_ORIGIN, } from "./constants.js";
+import { API_BASE, API_V2_BASE, API_RESOURCE, OAUTH_CLIENT_ID, OAUTH_DEVICE_AUTHORIZATION_URL, OAUTH_LOGIN_TIMEOUT_MS, OAUTH_TOKEN_URL, TEAMCLAWS_ORIGIN, } from "./constants.js";
 import { TeamClawsError } from "./errors.js";
 import { errorFromResponse, requestJson } from "./http.js";
 import { assertExactKeys, isObject, parseSafeUserResponse, requireHttpsUrl, requireInteger, requireString, } from "./validation.js";
 import { openExternalBrowser } from "./browser.js";
+import { OsMachineKeyProvider, } from "./machine-key.js";
+import { TargetAuthorization, } from "./target-authorization.js";
 const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 export class AuthService {
     fetcher;
@@ -12,6 +14,7 @@ export class AuthService {
     now;
     wait;
     loginTimeoutMs;
+    machineKeys;
     constructor(options) {
         this.fetcher = options.fetcher ?? fetch;
         this.store = options.store;
@@ -20,33 +23,47 @@ export class AuthService {
         this.now = options.now ?? Date.now;
         this.wait = options.wait ?? waitFor;
         this.loginTimeoutMs = options.loginTimeoutMs ?? OAUTH_LOGIN_TIMEOUT_MS;
+        this.machineKeys =
+            options.machineKeys ?? new OsMachineKeyProvider(this.store.root);
     }
     async login(email, signal) {
         const boundEmail = email === undefined ? undefined : parseLoginEmail(email);
-        const pending = await this.startDevice(boundEmail, signal);
+        const machineKey = await this.machineKeys.create();
+        const pending = await this.startDevice(boundEmail, machineKey, signal);
         this.output.loginBrowser(pending.verification_uri_complete);
         await this.openBrowser(pending.verification_uri_complete).catch(() => false);
-        const credential = await this.poll(pending, signal);
-        const user = await this.fetchIdentity(credential.access_token, signal);
-        await this.store.writeLogin(credential);
+        const { authorization_id, sub, machine_jkt } = await this.poll(pending, machineKey, signal);
+        if (machine_jkt !== machineKey.jkt)
+            throw invalidTokenResponse();
+        const grant = {
+            version: 2,
+            authorization_id,
+            sub,
+            machine_key: machineKey,
+        };
+        const user = await this.fetchIdentity(grant, signal);
+        if (user.id !== sub)
+            throw invalidTokenResponse();
+        await this.store.writeAuthorization(grant);
+        await this.store.removeLogin();
         this.output.loginComplete(user);
         return user;
     }
     async status(signal) {
-        const credential = await this.store.readLogin();
-        if (!credential) {
+        const grant = await this.store.readAuthorization();
+        if (!grant) {
             this.output.authStatus("signed_out");
             return undefined;
         }
         try {
-            const active = await this.ensureActive(credential, signal);
-            const user = await this.fetchIdentity(active.access_token, signal);
-            this.output.authStatus("signed_in", user, active.expires_at);
+            const user = await this.fetchIdentity(grant, signal);
+            this.output.authStatus("signed_in", user);
             return user;
         }
         catch (error) {
             if (error instanceof TeamClawsError &&
                 error.code === "invalid_authentication") {
+                await this.store.removeAuthorization();
                 await this.store.removeLogin();
                 this.output.authStatus("signed_out");
                 return undefined;
@@ -54,48 +71,30 @@ export class AuthService {
             throw error;
         }
     }
-    async logout(signal) {
-        const credential = await this.store.readLogin();
-        let remoteConfirmed = true;
-        if (credential) {
-            try {
-                await this.revoke(credential.refresh_token, signal);
-            }
-            catch {
-                remoteConfirmed = false;
-            }
+    async logout(signal, revokeGrant = false) {
+        const grant = await this.store.readAuthorization();
+        if (revokeGrant && grant) {
+            const url = `${API_V2_BASE}authorizations/${grant.authorization_id}/revoke/`;
+            const signer = new TargetAuthorization(this.store, this.fetcher, this.machineKeys, this.now);
+            const response = await requestJson(this.fetcher, url, {
+                method: "POST",
+                headers: await signer.accountHeadersForGrant(grant, "POST", url),
+                ...(signal ? { signal } : {}),
+            });
+            if (response.status !== 204)
+                throw errorFromResponse(response, "remote_logout_unconfirmed");
         }
         await this.store.removeLogin();
-        this.output.logoutComplete(remoteConfirmed);
-        return remoteConfirmed;
-    }
-    async accessToken(signal) {
-        const credential = await this.store.readLogin();
-        if (!credential)
-            return undefined;
-        const active = await this.ensureActive(credential, signal);
-        return active.access_token;
-    }
-    async requireAccessToken(message, signal) {
-        const token = await this.accessToken(signal);
-        if (!token) {
-            throw new TeamClawsError("login_required", message, { exitCode: 3 });
-        }
-        await this.fetchIdentity(token, signal);
-        return token;
-    }
-    async ensureActive(credential, signal) {
-        const expiresAt = Date.parse(credential.expires_at);
-        if (expiresAt - this.now() > 30_000)
-            return credential;
-        const refreshed = await this.refresh(credential.refresh_token, signal);
-        await this.store.writeLogin(refreshed);
-        return refreshed;
+        await this.store.removeAuthorization();
+        this.output.logoutComplete(true);
+        return true;
     }
-    async startDevice(email, signal) {
+    async startDevice(email, machineKey, signal) {
         const form = new URLSearchParams({
             client_id: OAUTH_CLIENT_ID,
             resource: API_RESOURCE,
+            scope: "basic",
+            machine_jwk: JSON.stringify(machineKey.public_jwk),
         });
         if (email)
             form.set("email", email);
@@ -109,7 +108,7 @@ export class AuthService {
         }
         return parseDeviceAuthorization(response.body);
     }
-    async poll(pending, signal) {
+    async poll(pending, machineKey, signal) {
         const startedAt = this.now();
         const deadline = Math.min(startedAt + pending.expires_in * 1_000, startedAt + this.loginTimeoutMs);
         let intervalSeconds = pending.interval;
@@ -119,6 +118,9 @@ export class AuthService {
                 break;
             const response = await requestJson(this.fetcher, OAUTH_TOKEN_URL, {
                 method: "POST",
+                headers: {
+                    DPoP: await new TargetAuthorization(this.store, this.fetcher, this.machineKeys, this.now).tokenDpop(machineKey),
+                },
                 form: new URLSearchParams({
                     grant_type: DEVICE_CODE_GRANT_TYPE,
                     device_code: pending.device_code,
@@ -128,7 +130,14 @@ export class AuthService {
                 ...(signal ? { signal } : {}),
             });
             if (response.status >= 200 && response.status < 300) {
-                return parseTokenResponse(response.body, this.now());
+                if (!isObject(response.body))
+                    throw invalidTokenResponse();
+                validateBootstrapTokens(response.body);
+                return {
+                    authorization_id: requireString(response.body.authorization_id, "authorization ID", 36),
+                    sub: requireString(response.body.sub, "user subject", 255),
+                    machine_jkt: requireString(response.body.machine_jkt, "machine key thumbprint", 43),
+                };
             }
             const code = oauthErrorCode(response.body);
             if (code === "authorization_pending") {
@@ -148,65 +157,28 @@ export class AuthService {
         }
         throw new TeamClawsError("login_timeout", "CLI sign-in timed out after 10 minutes.", { exitCode: 3 });
     }
-    async refresh(refreshToken, signal) {
-        try {
-            const response = await requestJson(this.fetcher, OAUTH_TOKEN_URL, {
-                method: "POST",
-                form: new URLSearchParams({
-                    grant_type: "refresh_token",
-                    refresh_token: refreshToken,
-                    client_id: OAUTH_CLIENT_ID,
-                    resource: API_RESOURCE,
-                }),
-                ...(signal ? { signal } : {}),
-            });
-            if (response.status < 200 || response.status >= 300) {
-                throw oauthError(response.status, response.body);
-            }
-            return parseTokenResponse(response.body, this.now());
-        }
-        catch (error) {
-            if (error instanceof TeamClawsError &&
-                error.code === "invalid_authentication") {
-                await this.store.removeLogin();
-            }
-            throw error;
-        }
-    }
-    async fetchIdentity(accessToken, signal) {
-        const response = await requestJson(this.fetcher, `${API_BASE}me/`, {
-            headers: { Authorization: `Bearer ${accessToken}` },
+    async fetchIdentity(grant, signal) {
+        const url = `${API_BASE}me/`;
+        const signer = new TargetAuthorization(this.store, this.fetcher, this.machineKeys, this.now);
+        const response = await requestJson(this.fetcher, url, {
+            headers: await signer.accountHeadersForGrant(grant, "GET", url),
             ...(signal ? { signal } : {}),
         });
         if (response.status === 401) {
-            throw new TeamClawsError("invalid_authentication", "The TeamClaws login is no longer valid. Run `teamclaws login` to authenticate.", {
+            throw new TeamClawsError("invalid_authentication", "The TeamClaws CLI authorization is inactive. Run `teamclaws login` to authorize this computer again.", {
                 exitCode: 3,
             });
         }
         if (response.status < 200 || response.status >= 300) {
             throw errorFromResponse(response, "identity_unavailable");
         }
-        return parseSafeUserResponse(response.body);
-    }
-    async revoke(refreshToken, signal) {
-        const timeout = AbortSignal.timeout(10_000);
-        const combined = signal ? AbortSignal.any([timeout, signal]) : timeout;
-        const response = await this.fetcher(OAUTH_REVOKE_URL, {
-            method: "POST",
-            headers: {
-                Accept: "application/json",
-                "Content-Type": "application/x-www-form-urlencoded",
-            },
-            body: new URLSearchParams({
-                token: refreshToken,
-                client_id: OAUTH_CLIENT_ID,
-            }),
-            redirect: "error",
-            signal: combined,
-        });
-        if (response.status < 200 || response.status >= 300) {
-            throw new TeamClawsError("remote_logout_unconfirmed", "Remote logout was not confirmed.");
-        }
+        if (!isObject(response.body) ||
+            response.body.authorization_id !== grant.authorization_id)
+            throw invalidTokenResponse();
+        const user = parseSafeUserResponse(response.body);
+        if (user.id !== grant.sub)
+            throw invalidTokenResponse();
+        return user;
     }
 }
 function parseDeviceAuthorization(body) {
@@ -239,21 +211,14 @@ function parseDeviceAuthorization(body) {
         interval: requireInteger(body.interval, "interval", 1, 60),
     };
 }
-function parseTokenResponse(body, now) {
+function validateBootstrapTokens(body) {
     if (!isObject(body))
         throw invalidTokenResponse();
-    const accessToken = requireToken(body.access_token);
-    const refreshToken = requireToken(body.refresh_token);
+    requireToken(body.access_token);
+    requireToken(body.refresh_token);
     if (body.token_type !== "Bearer")
         throw invalidTokenResponse();
-    const expiresIn = Math.min(requireInteger(body.expires_in, "access-token lifetime", 1, 86_400), ACCESS_TOKEN_MAX_LIFETIME_SECONDS);
-    return {
-        version: 1,
-        token_type: "Bearer",
-        access_token: accessToken,
-        refresh_token: refreshToken,
-        expires_at: new Date(now + expiresIn * 1_000).toISOString(),
-    };
+    requireInteger(body.expires_in, "access-token lifetime", 1, 86_400);
 }
 function parseLoginEmail(value) {
     const email = value.trim();