ftown-bridge 0.20.7 → 0.20.9

package/dist/bridge-auth.d.ts

@@ -1,3 +1,4 @@
+import { UnauthorizedError } from 'centrifuge';
 import type { AccountEnrollmentBundle, AccountHistory } from './security/account-protocol.js';
 /** Loopback advert embedded in the Centrifugo connection JWT `info` claim (L2). */
 export interface BridgeLocalAdvert {
@@ -13,6 +14,11 @@ export interface BridgeAuthResponse {
     accountApproval?: AccountEnrollmentBundle;
     accountHistory?: AccountHistory;
 }
+/** A 401 refresh that carries signed revocation evidence; still terminal for centrifuge-js. */
+export declare class BridgeRevokedError extends UnauthorizedError {
+    readonly evidence: AccountHistory;
+    constructor(evidence: AccountHistory);
+}
 export declare function fetchBridgeToken(apiUrl: string, authToken: string, bridgeId: string, local: BridgeLocalAdvert): Promise<BridgeAuthResponse>;
 /**
  * Exchange a (rotating) refresh token for a fresh Centrifugo connect token.

package/dist/bridge-auth.js

@@ -1,5 +1,15 @@
 import { hostname as osHostname } from 'node:os';
 import { UnauthorizedError } from 'centrifuge';
+import { parseBridgeRevokedBody } from './security/bridge/revocation.js';
+/** A 401 refresh that carries signed revocation evidence; still terminal for centrifuge-js. */
+export class BridgeRevokedError extends UnauthorizedError {
+    evidence;
+    constructor(evidence) {
+        super('Bridge revoked');
+        this.name = 'BridgeRevokedError';
+        this.evidence = evidence;
+    }
+}
 export async function fetchBridgeToken(apiUrl, authToken, bridgeId, local) {
     const res = await fetch(`${apiUrl}/api/auth/bridge`, {
         method: 'POST',
@@ -42,11 +52,15 @@ export async function refreshBridgeToken(apiUrl, refreshToken, bridgeId, local)
     });
     if (!res.ok) {
         const body = await res.text();
-        const message = `Token refresh failed (${res.status}): ${body}`;
+        // Capped: a malformed or oversized 401 body must not flood the logged error message.
+        const message = `Token refresh failed (${res.status}): ${body.slice(0, 200)}`;
         // A rejected bridge credential cannot become valid through retrying.
         // centrifuge-js only stops its token retry loop for UnauthorizedError;
         // ordinary errors are treated as transient and retried indefinitely.
         if (res.status === 401) {
+            const evidence = parseBridgeRevokedBody(body);
+            if (evidence !== null)
+                throw new BridgeRevokedError(evidence);
             throw new UnauthorizedError(message);
         }
         throw new Error(message);

package/dist/bridge-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"bridge-auth.js","sourceRoot":"","sources":["../src/bridge-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAmB/C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,QAAQ,EAAE,UAAU,EAAE;YACtB,uEAAuE;YACvE,kEAAkE;YAClE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,6EAA6E;SAC9E,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAAiC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,YAAoB,EACpB,QAAgB,EAChB,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,0BAA0B,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY;YACZ,QAAQ;YACR,QAAQ,EAAE,UAAU,EAAE;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,6EAA6E;SAC9E,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,yBAAyB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC;QAChE,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAAiC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"bridge-auth.js","sourceRoot":"","sources":["../src/bridge-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAkBzE,+FAA+F;AAC/F,MAAM,OAAO,kBAAmB,SAAQ,iBAAiB;IAC9C,QAAQ,CAAiB;IAElC,YAAY,QAAwB;QAClC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,SAAiB,EACjB,QAAgB,EAChB,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,QAAQ,EAAE,UAAU,EAAE;YACtB,uEAAuE;YACvE,kEAAkE;YAClE,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,6EAA6E;SAC9E,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAAiC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,YAAoB,EACpB,QAAgB,EAChB,KAAwB;IAExB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,0BAA0B,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,YAAY;YACZ,QAAQ;YACR,QAAQ,EAAE,UAAU,EAAE;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,6EAA6E;SAC9E,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,qFAAqF;QACrF,MAAM,OAAO,GAAG,yBAAyB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9E,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC9D,MAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,EAAiC,CAAC;AACnD,CAAC"}

package/dist/identity-reset.d.ts

@@ -0,0 +1,10 @@
+export type IdentityResetReason = 'revoked' | 'manual';
+export interface IdentityResetResult {
+    oldBridgeId: string | null;
+    newBridgeId: string;
+    reason: IdentityResetReason;
+}
+export declare function beginIdentityReset(dataDir: string, reason: IdentityResetReason): void;
+export declare function completePendingIdentityReset(dataDir: string): IdentityResetResult | null;
+export declare function argvForPairingRestart(argv: readonly string[]): string[];
+export declare function reexec(scriptPath: string, argv: string[]): boolean;

package/dist/identity-reset.js

@@ -0,0 +1,166 @@
+import { accessSync, closeSync, constants, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, unlinkSync, writeSync } from 'node:fs';
+import { join } from 'node:path';
+import { v4 as uuidv4 } from 'uuid';
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const markerPath = (dataDir) => join(dataDir, 'security', 'identity-reset.json');
+function errCode(err) {
+    return err?.code;
+}
+/** Missing file counts as done; any other fs failure must surface. */
+function removeIfPresent(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch (err) {
+        if (errCode(err) !== 'ENOENT')
+            throw err;
+    }
+}
+function syncDir(dir) {
+    let fd;
+    try {
+        fd = openSync(dir, 'r');
+    }
+    catch {
+        return;
+    }
+    try {
+        fsyncSync(fd);
+    }
+    catch { /* directory fsync is unsupported on some platforms */ }
+    finally {
+        closeSync(fd);
+    }
+}
+function writeAtomic(path, dir, content) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${path}.${uuidv4()}.tmp`;
+    const fd = openSync(tmp, 'wx', 0o600);
+    try {
+        try {
+            writeSync(fd, content);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        rmSync(tmp, { force: true });
+        throw err;
+    }
+    syncDir(dir);
+}
+/** null = no marker file; undefined = marker present but invalid. */
+function readMarker(dataDir) {
+    let raw;
+    try {
+        raw = readFileSync(markerPath(dataDir), 'utf8');
+    }
+    catch (err) {
+        if (errCode(err) === 'ENOENT')
+            return null;
+        throw err;
+    }
+    try {
+        const v = JSON.parse(raw);
+        if (typeof v !== 'object' || v === null)
+            return undefined;
+        const m = v;
+        if (m.version !== 1 || (m.reason !== 'revoked' && m.reason !== 'manual'))
+            return undefined;
+        if (typeof m.requestedAt !== 'string' || typeof m.newBridgeId !== 'string' || !UUID_RE.test(m.newBridgeId))
+            return undefined;
+        return { version: 1, reason: m.reason, requestedAt: m.requestedAt, newBridgeId: m.newBridgeId };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function beginIdentityReset(dataDir, reason) {
+    if (readMarker(dataDir))
+        return;
+    const marker = { version: 1, reason, requestedAt: new Date().toISOString(), newBridgeId: uuidv4() };
+    writeAtomic(markerPath(dataDir), join(dataDir, 'security'), JSON.stringify(marker));
+}
+export function completePendingIdentityReset(dataDir) {
+    const marker = readMarker(dataDir);
+    if (marker === null)
+        return null;
+    // A corrupt marker cannot name the new identity; leave it for beginIdentityReset to replace.
+    if (marker === undefined)
+        return null;
+    const securityDir = join(dataDir, 'security');
+    const bridgeIdPath = join(dataDir, 'bridge-id');
+    let oldBridgeId = null;
+    try {
+        oldBridgeId = readFileSync(bridgeIdPath, 'utf8').trim() || null;
+    }
+    catch (err) {
+        if (errCode(err) !== 'ENOENT')
+            throw err;
+    }
+    // A crash after step 5 already holds the new id; the previous one is unknowable then.
+    if (oldBridgeId === marker.newBridgeId)
+        oldBridgeId = null;
+    removeIfPresent(join(dataDir, 'refresh-token'));
+    for (const name of ['account-enrollment.json', 'pending-approval-status.json', 'pending-approval-confirmation.json', 'local-cli-identity.json']) {
+        removeIfPresent(join(securityDir, name));
+    }
+    removeIfPresent(join(dataDir, 'browser-devices.json'));
+    removeIfPresent(join(securityDir, 'policy.json'));
+    removeIfPresent(join(securityDir, 'bridge-identity.json'));
+    // Deletions must be durable before the new id lands.
+    syncDir(securityDir);
+    syncDir(dataDir);
+    writeAtomic(bridgeIdPath, dataDir, `${marker.newBridgeId}\n`);
+    removeIfPresent(markerPath(dataDir));
+    syncDir(securityDir);
+    return { oldBridgeId, newBridgeId: marker.newBridgeId, reason: marker.reason };
+}
+// Every value-taking `ftown start` option (index.ts); each consumes its next token verbatim.
+const VALUE_OPTIONS = ['--port', '--token', '--account', '--api-url', '--data-dir', '--bridge-id'];
+const DROPPED_OPTIONS = ['--bridge-id', '--account', '--token'];
+export function argvForPairingRestart(argv) {
+    const out = [];
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '--new-identity' || a.startsWith('--new-identity='))
+            continue;
+        if (VALUE_OPTIONS.some((f) => a.startsWith(`${f}=`))) {
+            if (!DROPPED_OPTIONS.some((f) => a.startsWith(`${f}=`)))
+                out.push(a);
+            continue;
+        }
+        if (VALUE_OPTIONS.includes(a)) {
+            const hasValue = i + 1 < argv.length;
+            if (!DROPPED_OPTIONS.includes(a)) {
+                out.push(a);
+                if (hasValue)
+                    out.push(argv[i + 1]);
+            }
+            i++;
+            continue;
+        }
+        out.push(a);
+    }
+    if (!out.includes('--bootstrap'))
+        out.push('--bootstrap');
+    return out;
+}
+export function reexec(scriptPath, argv) {
+    if (typeof process.execve !== 'function')
+        return false;
+    // A failing execve aborts the process (SIGABRT) instead of throwing, e.g. when the node binary was replaced under us.
+    try {
+        accessSync(process.execPath, constants.X_OK);
+        accessSync(scriptPath, constants.R_OK);
+    }
+    catch {
+        return false;
+    }
+    process.execve(process.execPath, [process.execPath, ...process.execArgv, scriptPath, ...argv], process.env);
+    return true;
+}
+//# sourceMappingURL=identity-reset.js.map

package/dist/identity-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-reset.js","sourceRoot":"","sources":["../src/identity-reset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpJ,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAOpC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;AAEjG,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAQ,GAAoC,EAAE,IAAI,CAAC;AACrD,CAAC;AAED,sEAAsE;AACtE,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACzB,OAAO,GAAG,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAAC,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IAClD,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACpH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,OAAe;IAC7D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC;IACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,CAAC;YAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACzE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACxD,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3F,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7H,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAA2B;IAC7E,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAW,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC;IAC5G,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,6FAA6F;IAC7F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAEhD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,CAAC;QAAC,WAAW,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAAC,CAAC;IACxE,OAAO,GAAG,EAAE,CAAC;QAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAAC,CAAC;IACzD,sFAAsF;IACtF,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW;QAAE,WAAW,GAAG,IAAI,CAAC;IAE3D,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,CAAC,yBAAyB,EAAE,8BAA8B,EAAE,oCAAoC,EAAE,yBAAyB,CAAC,EAAE,CAAC;QAChJ,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACvD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;IAClD,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC3D,qDAAqD;IACrD,OAAO,CAAC,WAAW,CAAC,CAAC;IACrB,OAAO,CAAC,OAAO,CAAC,CAAC;IACjB,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IAC9D,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,WAAW,CAAC,CAAC;IAErB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACjF,CAAC;AAED,6FAA6F;AAC7F,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AACnG,MAAM,eAAe,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AAEhE,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,gBAAgB,IAAI,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAAE,SAAS;QACxE,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YACrC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,IAAI,QAAQ;oBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YACvF,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,UAAkB,EAAE,IAAc;IACvD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACvD,sHAAsH;IACtH,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5G,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.js

@@ -32,6 +32,7 @@ import { selectBridgePairingMode, waitForPendingBridgeDecision, writePendingBrid
 import { readAccountHistory } from './security/bridge/account-client.js';
 import { openAccountApproval } from './security/account-crypto.js';
 import { BridgeSecurityService, applicationJson } from './security/bridge/security.js';
+import { readPinnedAccountCheckpoint } from './security/bridge/policy.js';
 import { createCommandHandler } from './command-rpc.js';
 import { PullRequestStatusService } from './pull-request-status.js';
 import { createPrReviewService } from './pull-request-review.js';
@@ -42,7 +43,10 @@ import { TerminalPump } from './terminal-pump.js';
 import { collectSessionUsage } from './usage-collector.js';
 import { AgentSessionIdPersister } from './session-ids.js';
 import { HookUsagePersister } from './hook-usage.js';
-import { fetchBridgeToken, refreshBridgeToken } from './bridge-auth.js';
+import { BridgeRevokedError, fetchBridgeToken, refreshBridgeToken } from './bridge-auth.js';
+import { beginIdentityReset, completePendingIdentityReset } from './identity-reset.js';
+import { createRevokedRestart } from './revoked-restart.js';
+import { bridgeMode, canReexecAfterRevocation, handlesRevocation, restartForPinnedRevocation, restartForRefreshError } from './revocation-gating.js';
 import { RotatingTokenRefresher } from './rotating-token-refresher.js';
 import { resolveDefaultDataDir, resolveFtownHome } from './ftown-home.js';
 import { SessionController } from './session-controller.js';
@@ -104,6 +108,7 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
         .option('--api-url <url>', 'ftown UI API URL', DEFAULT_API_URL)
         .option('--data-dir <path>', 'Directory for session data (default: ~/.ftown/data)')
         .option('--bridge-id <id>', 'Bridge instance ID (default: persisted per data dir)')
+        .option('--new-identity', 'Forget this computer’s account identity and credentials, then pair it again as a new computer with a private link (sessions are kept)')
         .action(async (opts) => {
         if (opts.local && opts.solo)
             program.error('--local and --solo cannot be combined');
@@ -111,6 +116,8 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
             program.error('--account and --bootstrap cannot be combined');
         if ((opts.local || opts.solo) && (opts.account !== undefined || opts.bootstrap))
             program.error('--account and --bootstrap require cloud mode');
+        if ((opts.local || opts.solo) && opts.newIdentity)
+            program.error('--new-identity requires cloud mode');
         const apiUrl = new URL(opts.apiUrl);
         const isLocalHost = apiUrl.hostname === 'localhost' ||
             apiUrl.hostname === '127.0.0.1' ||
@@ -121,16 +128,46 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
                 'Bridge tokens would otherwise cross the network unencrypted. ' +
                 'Set FTOWN_ALLOW_INSECURE_API=1 to override for trusted LAN setups.');
         }
-        // Restart context is authenticated by the private helper channel before any mutation.
-        assertUpdateReservationAllowed(homedir());
-        const updateRestart = readUpdateRestartContext();
-        if (updateRestart && (updateRestart.targetVersion !== BRIDGE_VERSION || opts.token || opts.account || opts.bootstrap || opts.solo))
-            throw new Error('Invalid update restart context');
         // Explicit setup must finish before any migration, identity, network or auth side effect.
         assertSetupReady(BRIDGE_VERSION);
         // Read-only default resolution; explicit setup owns legacy data migration.
         const defaultDataDir = resolveDefaultDataDir();
         const dataDir = opts.dataDir ? resolve(opts.dataDir) : defaultDataDir;
+        // No bridge starts, and no identity is reset, while an update holds the reservation.
+        assertUpdateReservationAllowed(homedir());
+        if (opts.newIdentity)
+            beginIdentityReset(dataDir, 'manual');
+        // Also finishes a reset that a revoked restart or a crash left pending.
+        const identityReset = completePendingIdentityReset(dataDir);
+        let updateRestart = null;
+        if (identityReset) {
+            console.log(`[Bridge] New identity for this computer: ${identityReset.oldBridgeId ?? 'unknown'} -> ${identityReset.newBridgeId}`);
+            if (opts.bridgeId !== undefined) {
+                console.warn('[Bridge] Ignoring --bridge-id: this computer has a new identity.');
+                opts.bridgeId = undefined;
+            }
+            // A reset bridge is a fresh install; an update context names the identity it just discarded.
+            try {
+                if (readUpdateRestartContext())
+                    console.warn('[Bridge] Ignoring the update restart context: this computer has a new identity.');
+            }
+            catch (err) {
+                console.warn('[Bridge] Ignoring an invalid update restart context after the identity reset:', err instanceof Error ? err.message : String(err));
+            }
+            if (!opts.local && !opts.solo) {
+                if (opts.token !== undefined || opts.account !== undefined)
+                    console.warn('[Bridge] Ignoring --token and --account: a new identity pairs with a private link.');
+                opts.token = undefined;
+                opts.account = undefined;
+                opts.bootstrap = true;
+            }
+        }
+        else {
+            // Restart context is authenticated by the private helper channel before any mutation.
+            updateRestart = readUpdateRestartContext();
+            if (updateRestart && (updateRestart.targetVersion !== BRIDGE_VERSION || opts.token || opts.account || opts.bootstrap || opts.solo))
+                throw new Error('Invalid update restart context');
+        }
         // Every child/local CLI must resolve this exact instance, including custom --data-dir bridges.
         process.env.FTOWN_DATA_DIR = dataDir;
         // Instance-scoped ".ftown home" for pointer and registry files. The DEFAULT
@@ -166,6 +203,22 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
         catch (err) {
             console.error('[Bridge] Failed to persist bridge id:', err instanceof Error ? err.message : String(err));
         }
+        // Signed revocation of this bridgeId restarts the process as a fresh install, at most once.
+        // The re-exec keeps this PID, so whatever startup has acquired so far is released first.
+        let releaseForRestart = async () => { };
+        // Mirrors the update coordinator's receipts; an active operation holds the reservation under this PID.
+        let updatePhase = null;
+        const revokedRestart = createRevokedRestart({
+            dataDir, scriptPath: process.argv[1], argv: process.argv.slice(2),
+            shutdown: () => releaseForRestart(), log: message => console.log(message), exit: code => process.exit(code),
+            canReexec: () => canReexecAfterRevocation({ updateRestart: updateRestart !== null, updatePhase }),
+        });
+        const securityDir = join(dataDir, 'security');
+        const runMode = bridgeMode(opts);
+        if (restartForPinnedRevocation(runMode, readPinnedAccountCheckpoint(securityDir), bridgeId)) {
+            await revokedRestart();
+            return;
+        }
         // L4: --rotate-key short-circuits BEFORE any listener binds (exit 0,
         // nothing started). Without --solo it is an argument error.
         if (opts.rotateKey && !opts.solo) {
@@ -208,6 +261,7 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
             localApiServer.stop();
             throw new Error('Update restart endpoint is unavailable');
         }
+        releaseForRestart = async () => { localApiServer.stop(); };
         writeFileSync(localPortPath, `${hookPort}\n`, { mode: 0o600 });
         console.log(`[Bridge] Local API server started on port ${hookPort}`);
         const localNonce = randomBytes(16).toString('hex');
@@ -492,6 +546,11 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
                 auth = await refreshBridgeToken(opts.apiUrl, persistedRefreshToken, bridgeId, local);
             }
             catch (err) {
+                // Only a refusal whose signed history verifies against our own pin resets; anything else keeps today's path.
+                if (await restartForRefreshError({ mode: runMode, error: err, pinned: readPinnedAccountCheckpoint(securityDir), bridgeId })) {
+                    await revokedRestart();
+                    return;
+                }
                 if (updateRestart)
                     throw new Error('Update restart authentication failed');
                 console.warn('[Bridge] Stored refresh token rejected, falling back to bootstrap token / pairing:', err instanceof Error ? err.message : String(err));
@@ -564,8 +623,17 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
             localOrigin: `http://127.0.0.1:${hookPort}`,
             readAccountHistory: !solo && !opts.local ? signal => readAccountHistory(opts.apiUrl, currentBridgeToken, signal) : undefined,
         });
+        releaseForRestart = async () => { localApiServer.stop(); await security.close(); };
+        let bridgeRevoked = false;
+        if (handlesRevocation(runMode))
+            security.onBridgeRevoked(() => { bridgeRevoked = true; void revokedRestart(); });
         await security.policy.provisionLocalEndpoint(localIdentity.endpoint);
         await security.startAccount(accountBootstrap);
+        // The startup read may prove the revocation; stop here instead of registering a revoked endpoint.
+        if (bridgeRevoked) {
+            await revokedRestart();
+            return;
+        }
         if (!solo && !opts.local) {
             const registration = await fetch(`${opts.apiUrl.replace(/\/$/, '')}/api/security/endpoints`, { method: 'PUT',
                 headers: { Authorization: `Bearer ${currentBridgeToken}`, 'Content-Type': 'application/json' },
@@ -592,8 +660,23 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
                     info: { bridgeId, hostname: osHostname() },
                 });
             }
-            console.log('[Bridge] Refreshing Centrifugo token...');
-            const token = await tokenRefresher.getToken();
+            // centrifuge-js polls every 5-10 s during a cooldown; stay quiet.
+            if (tokenRefresher.cooldownRemainingMs() <= 0) {
+                console.log('[Bridge] Refreshing Centrifugo token...');
+            }
+            let token;
+            try {
+                token = await tokenRefresher.getToken();
+            }
+            catch (err) {
+                // The refusal is unverified; the security service checks it against the pinned account state.
+                if (err instanceof BridgeRevokedError) {
+                    security.confirmRevocationEvidence(err.evidence).catch((confirmErr) => {
+                        console.error('[Bridge] Failed to verify revocation evidence:', confirmErr instanceof Error ? confirmErr.message : String(confirmErr));
+                    });
+                }
+                throw err;
+            }
             console.log('[Bridge] Token refreshed successfully');
             return token;
         }
@@ -875,8 +958,8 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
             discard: discardPreparedRelease,
             reserve: operationId => reserveUpdate(updateHome, operationId),
             prepareHandoff, readReceipt: () => readUpdateReceipt(stagingRoot),
-            writeReceipt: receipt => writeUpdateReceipt(stagingRoot, receipt),
-            shutdown: () => shutdown(), admission: updateAdmission,
+            writeReceipt: receipt => { updatePhase = receipt.operation.phase; return writeUpdateReceipt(stagingRoot, receipt); },
+            shutdown: () => shutdownAndExit(), admission: updateAdmission,
         });
         // Pointer lives under the instance home (see configure* above): default →
         // $HOME/.ftown (harness CLIs read it there), custom --data-dir → that dir.
@@ -1034,45 +1117,66 @@ export async function runBridge(argv, commandName = 'ftown-bridge') {
                 }
             })();
         }, 2000);
-        let shuttingDown = false;
-        const shutdown = async () => {
-            if (shuttingDown)
-                return;
-            shuttingDown = true;
-            console.log('\n[Bridge] Shutting down...');
-            await pullRequestEvents.stop();
-            attentionStore.stopNotifications();
-            stopPushSessionObserver();
-            pushNotifier?.stop();
-            // Solo L2 ordering: stop accepting first, then children (panel before
-            // hub), then the rest of the bridge teardown.
-            if (solo) {
-                void solo.front.close().catch(() => { });
-                solo.panel.stop();
-                solo.hub.stop();
-            }
-            localApiServer.stop();
-            runner.stopAll();
-            loopbackServer.closeAll();
-            directPeers.closeAll();
-            watchRegistry.dispose();
-            // node-datachannel module-level cleanup — avoids the native crash-on-exit race.
-            try {
-                ndcCleanup();
-            }
-            catch { /* native lib already torn down */ }
-            centrifugo.disconnect();
+        // Leaves tmux sessions running and the process alive; a revoked restart re-executes this same PID
+        // afterwards, so the local port, pointer, relay connection and timers must all be released here.
+        let shutdownRun;
+        function shutdown() {
+            shutdownRun ??= (async () => {
+                console.log('\n[Bridge] Shutting down...');
+                try {
+                    await pullRequestEvents.stop();
+                    attentionStore.stopNotifications();
+                    stopPushSessionObserver();
+                    pushNotifier?.stop();
+                    // Solo L2 ordering: stop accepting first, then children (panel before
+                    // hub), then the rest of the bridge teardown.
+                    if (solo) {
+                        void solo.front.close().catch(() => { });
+                        solo.panel.stop();
+                        solo.hub.stop();
+                    }
+                }
+                finally {
+                    // The port and the pointer would outlive a same-PID re-exec, so no earlier failure may skip them.
+                    try {
+                        localApiServer.stop();
+                    }
+                    finally {
+                        cleanupPointer();
+                    }
+                }
+                runner.stopAll();
+                loopbackServer.closeAll();
+                directPeers.closeAll();
+                watchRegistry.dispose();
+                // node-datachannel module-level cleanup — avoids the native crash-on-exit race.
+                try {
+                    ndcCleanup();
+                }
+                catch { /* native lib already torn down */ }
+                centrifugo.disconnect();
+                try {
+                    await security.close();
+                }
+                catch (err) {
+                    console.error('[Bridge] Failed to persist security shutdown state.');
+                    throw err;
+                }
+            })();
+            return shutdownRun;
+        }
+        const shutdownAndExit = async () => {
             try {
-                await security.close();
-                process.exit(0);
+                await shutdown();
             }
             catch {
-                console.error('[Bridge] Failed to persist security shutdown state.');
                 process.exit(1);
             }
+            process.exit(0);
         };
-        process.on('SIGINT', shutdown);
-        process.on('SIGTERM', shutdown);
+        releaseForRestart = shutdown;
+        process.on('SIGINT', () => { void shutdownAndExit(); });
+        process.on('SIGTERM', () => { void shutdownAndExit(); });
     });
     registerLocalBrowserCommands(program);
     try {