v0.5.0

lofi-node 0.5.0 adds device-bound sync tickets and connection visibility.

Device-bound sync tickets (proof of possession)

A sync ticket can now be bound to the device that enrolls it. When a lofi app offers a device public key at the scope-down exchange, the derived sync ticket only works together with a signature from that device's key — which never leaves the device. A ticket string that leaks through a backup, a log, or a copied URL no longer grants access on its own.

• The bare secret of a bound ticket answers only liveness checks and the possession exchange; all sync traffic requires a short-lived connect token minted by a fresh signature.
• Challenges are single-use and expire quickly; every failure answers with the same response, so probing reveals nothing.
• Connect tokens live in memory only: a node restart invalidates them and clients re-run the exchange on their next start. Revoking a ticket kills its tokens and closes its live connections, exactly as before.
• Unbound tickets are unchanged. Apps and nodes on different versions fall back to the existing bearer behavior in every combination.

Binding protects against theft of the ticket string. It does not protect against code running inside the app's own page while it is open, and a node build predating this release serves a bound ticket as a plain bearer ticket — both stated in the ticket contract (docs/app-ticket.md).

Connection visibility

• lofi-node ticket list now shows when each ticket was last seen, answering "is that phone still using this ticket?" before revoking it. Last-seen survives node restarts and is written by the running node about once a minute.
• node.status() reports live gated connections per ticket, joined with ticket labels, for embedders and the startup summary.

Assets

Compiled binaries for macOS (Apple silicon) and Linux x86_64, plus the native addon libraries the JSR package downloads and verifies by digest. The native addon is unchanged from 0.4.0.