@openacp/cli 2026.414.1 → 2026.414.2

package/dist/cli.js

@@ -2633,6 +2633,22 @@ function registerSetupRoutes(app, deps) {
       if (user2) return user2;
     }
     const body = request.body;
+    if (body?.identitySecret) {
+      const oldToken = tokenStore?.getByIdentitySecret(body.identitySecret);
+      if (!oldToken) {
+        return reply.status(401).send({ error: "Invalid identity secret" });
+      }
+      const userId = tokenStore?.getUserId(oldToken.id);
+      if (!userId) {
+        return reply.status(401).send({ error: "No identity linked to this secret" });
+      }
+      await service.createIdentity(userId, {
+        source: "api",
+        platformId: auth.tokenId
+      });
+      tokenStore?.setUserId?.(auth.tokenId, userId);
+      return service.getUser(userId);
+    }
     if (body?.linkCode) {
       const entry = linkCodes.get(body.linkCode);
       if (!entry || entry.expiresAt < Date.now()) {
@@ -8273,9 +8289,15 @@ var init_token_store = __esm({
             return;
           }
           this.tokens.clear();
+          let needsMigration = false;
           for (const token of parsed.tokens) {
+            if (!token.identitySecret) {
+              token.identitySecret = randomBytes2(16).toString("hex");
+              needsMigration = true;
+            }
             this.tokens.set(token.id, token);
           }
+          if (needsMigration) this.scheduleSave();
           this.codes.clear();
           for (const code of parsed.codes ?? []) {
             this.codes.set(code.code, code);
@@ -8321,7 +8343,8 @@ var init_token_store = __esm({
           scopes: opts.scopes,
           createdAt: now.toISOString(),
           refreshDeadline: new Date(now.getTime() + REFRESH_DEADLINE_MS).toISOString(),
-          revoked: false
+          revoked: false,
+          identitySecret: randomBytes2(16).toString("hex")
         };
         this.tokens.set(token.id, token);
         this.scheduleSave();
@@ -8390,6 +8413,19 @@ var init_token_store = __esm({
       getUserId(tokenId) {
         return this.tokens.get(tokenId)?.userId;
       }
+      /**
+       * Looks up a non-revoked token by its identity secret.
+       *
+       * Used by the identity re-link flow: the App sends the old token's identitySecret
+       * to prove continuity of identity when reconnecting with a new JWT.
+       * Returns undefined if no match, or if the matching token is revoked.
+       */
+      getByIdentitySecret(secret) {
+        for (const token of this.tokens.values()) {
+          if (!token.revoked && token.identitySecret === secret) return token;
+        }
+        return void 0;
+      }
       /**
        * Generates a one-time authorization code that can be exchanged for a JWT.
        *
@@ -10812,7 +10848,8 @@ async function authRoutes(app, deps) {
       tokenId: stored.id,
       accessToken,
       expiresAt,
-      refreshDeadline: stored.refreshDeadline
+      refreshDeadline: stored.refreshDeadline,
+      identitySecret: stored.identitySecret
     };
   });
   app.get("/tokens", {
@@ -11572,7 +11609,8 @@ function createApiServerPlugin() {
             accessToken,
             tokenId: token.id,
             expiresAt: new Date(Date.now() + parseDuration2(code.expire)).toISOString(),
-            refreshDeadline: token.refreshDeadline
+            refreshDeadline: token.refreshDeadline,
+            identitySecret: token.identitySecret
           });
         });
       }, { auth: false });