feat(contract): role watch and capability cmd.exchange

.changeset/watch-registry-names.md

@@ -0,0 +1,5 @@
+---
+"ftw-webapp": patch
+---
+
+Name role `watch` and capability `cmd.exchange` in the shared contract, for an Apple Watch that works without the phone. This app labels a watch as Watch in the device list and uses neither name otherwise.

contract/registry.yaml

@@ -80,6 +80,10 @@ capabilities:
   # only and offers no FTW Cloud. It says nothing about whether the owner
   # turned FTW Cloud on; the box's grant decides that.
   - cloud.link
+  # The box can take a watch: it opens the relay's exchange socket and mints
+  # watch codes. Absent means the phone offers no Add watch. The wire is
+  # docs/watch-exchange.md in srcfl/ftw-webapp.
+  - cmd.exchange
 
 # ---------------------------------------------------------------------------
 # Scopes. One object axis, two verb axes: <object>.<read|write>.
@@ -104,6 +108,13 @@ roles:
   viewer:
     label: Viewer
     scopes: [ftw.live.read]
+  # A watch that an owner phone added. That phone is its parent, and each check
+  # keeps only the scopes below that the parent holds at that moment, so a
+  # watch never does more than its phone can do now. Read and charge: no site
+  # mode, no members, no history and no passthrough.
+  watch:
+    label: Watch
+    scopes: [ftw.live.read, ftw.plan.read, ftw.events.read, ftw.dispatch.write]
 
 # ---------------------------------------------------------------------------
 # FTW Cloud. What an owner can let the box share with FTW Cloud, and why.

src/lib/protocol/contract.ts

@@ -38,12 +38,14 @@ export type Scope = (typeof SCOPES)[number]
 export const ROLE_SCOPES: Record<string, readonly string[]> = {
   owner: SCOPES,
   viewer: ['ftw.live.read'],
+  watch: ['ftw.live.read', 'ftw.plan.read', 'ftw.events.read', 'ftw.dispatch.write'],
 }
 
 /** The label the registry gives each role. The app owns no other wording. */
 export const ROLE_LABELS: Record<string, string> = {
   owner: 'Owner',
   viewer: 'Viewer',
+  watch: 'Watch',
 }
 
 /** Whether a role carries a scope. An unknown role carries nothing. */