ftown 0.20.9 → 0.21.0

package/dist/ledger-startup.js

@@ -0,0 +1,203 @@
+/*
+ * Account-mode startup decisions (passkey ledger), kept out of index.ts so each one is unit-tested:
+ * - step 2: which identity reset runs before anything else (resetIdentityForStart);
+ * - steps 3-4: pairing, ledger recovery and this bridge's own status (startAccountIdentity);
+ * - steps 5-6: the first relay token (online, offline or exit) and the endpoint registration (startRelay, createEndpointRegistrar).
+ * Solo and --local never enter any of it: they only finish a reset that is already pending, exactly as before.
+ */
+import { beginIdentityReset, completePendingIdentityReset } from './identity-reset.js';
+import { hasLegacyAccountState, loadOrCreateLedgerIdentity, readLedgerIdentity } from './security/bridge/ledger-identity.js';
+import { BridgeLedgerStore, LedgerStoreError, reconcileIdentityAndStore } from './security/bridge/ledger-store.js';
+import { MISSING_RELAY_URL_MESSAGE, isRefusal, relayTokenFailureMessage } from './ledger-relay.js';
+export const LEGACY_ACCOUNT_RESET_MESSAGE = '[Bridge] Old account data from a previous ftown version was cleared. Pair this computer again with the link below.';
+export const NOT_IN_LEDGER_MESSAGE = "This computer is not in your account's ledger. Run `ftown start --new-identity` to pair it again.";
+export const PAIRING_REJECTED_HINT = 'Pairing did not complete. Run `ftown start` to try again.';
+export const SERVER_LEDGER_MISMATCH_MESSAGE = "[Bridge] The server's account ledger does not list this computer. If it was removed from your account, run `ftown start --new-identity` to pair it again.";
+export const UPDATE_RESTART_UNPAIRED_MESSAGE = '[Bridge] An update restart cannot pair this computer. Run `ftown start` to pair it.';
+export const UPDATED_TO_LEDGER_MESSAGE = '[Bridge] ftown was updated to the passkey ledger; run `ftown start` to pair this computer.';
+/** Only account bridges use the passkey ledger (legacy reset, pairing, ledger replica, relay token by proof). */
+export function usesLedger(mode) {
+    return mode === 'account';
+}
+/**
+ * Step 2. Account mode: `--new-identity`, or any v1 account state on disk, starts a manual reset (the latter says so in one line).
+ * An update restart (a v1 -> v2 auto-update) has no visible terminal for the pairing link: with v1 state on disk it changes nothing
+ * and exits, and the next `ftown start` resets and pairs. Every mode then finishes a pending reset, as before (a revoked restart or a
+ * crash may have left one).
+ */
+export function resetIdentityForStart(input, deps = {}) {
+    const legacy = deps.hasLegacyAccountState ?? hasLegacyAccountState;
+    const begin = deps.beginIdentityReset ?? beginIdentityReset;
+    const complete = deps.completePendingIdentityReset ?? completePendingIdentityReset;
+    if (usesLedger(input.mode)) {
+        if (input.newIdentity)
+            begin(input.dataDir, 'manual');
+        else if (legacy(input.dataDir)) {
+            if (input.updateRestart)
+                return { kind: 'exit', message: UPDATED_TO_LEDGER_MESSAGE };
+            input.log(LEGACY_ACCOUNT_RESET_MESSAGE);
+            begin(input.dataDir, 'manual');
+        }
+    }
+    return { kind: 'continue', reset: complete(input.dataDir) };
+}
+/** Step 4. Only a signed revocation resets the identity; a bridge the ledger does not list fails closed and is never reset. */
+export function ownStatusAction(own) {
+    if (own === 'active')
+        return 'continue';
+    if (own === 'revoked')
+        return 'revoked_restart';
+    return 'exit_absent';
+}
+const messageOf = (error) => error instanceof Error ? error.message : String(error);
+export function ledgerUnavailableMessage(reason) {
+    return `[Bridge] Could not load your account ledger from the server (${reason}). Check the connection and run \`ftown start\` again.`;
+}
+function bound(identity) {
+    return identity !== null && identity.endpoint !== null && identity.accountId !== null;
+}
+/**
+ * Steps 3-4, account mode only, before any network use of the identity:
+ * - keys exist (created when absent), then identity and replica are reconciled;
+ * - 'unpaired' -> one pairing attempt (expired/rejected -> exit 1 with the hint);
+ * - 'needs_ledger' -> the server ledger is adopted only through adoptBound (any failure -> exit 1; the identity stays bound);
+ * - own status from the trusted replica: 'revoked' -> revoked restart; 'absent' -> exit 1 (never a reset); 'active' -> ready.
+ * Corrupted local files throw (they are never reset).
+ */
+export async function startAccountIdentity(deps) {
+    const loadOrCreate = deps.loadOrCreateIdentity ?? loadOrCreateLedgerIdentity;
+    const reconcile = deps.reconcile ?? ((dataDir) => reconcileIdentityAndStore(dataDir));
+    const readIdentity = deps.readIdentity ?? readLedgerIdentity;
+    const keys = await loadOrCreate(deps.dataDir);
+    const reconciled = await reconcile(deps.dataDir);
+    if (reconciled === 'unpaired') {
+        if (!deps.allowPairing)
+            return { kind: 'exit', message: UPDATE_RESTART_UNPAIRED_MESSAGE };
+        try {
+            await deps.pair(keys, new BridgeLedgerStore(deps.dataDir));
+        }
+        catch (error) {
+            const code = messageOf(error);
+            if (code === 'pairing_expired')
+                return { kind: 'exit', message: null };
+            if (code === 'pairing_rejected')
+                return { kind: 'exit', message: PAIRING_REJECTED_HINT };
+            throw error;
+        }
+    }
+    const identity = await readIdentity(deps.dataDir);
+    if (!bound(identity))
+        return { kind: 'exit', message: PAIRING_REJECTED_HINT };
+    const store = new BridgeLedgerStore(deps.dataDir, { accountId: identity.accountId });
+    if (reconciled === 'needs_ledger') {
+        try {
+            await store.adoptBound(await deps.fetchLedger(identity.accountId));
+        }
+        catch (error) {
+            if (error instanceof LedgerStoreError && error.code === 'ledger_store_bound_rejected')
+                return { kind: 'exit', message: SERVER_LEDGER_MISMATCH_MESSAGE };
+            return { kind: 'exit', message: ledgerUnavailableMessage(messageOf(error)) };
+        }
+    }
+    const action = ownStatusAction(await store.ownBridgeStatus(deps.bridgeId, identity.authPublicKey));
+    if (action === 'revoked_restart')
+        return { kind: 'revoked' };
+    if (action === 'exit_absent')
+        return { kind: 'exit', message: NOT_IN_LEDGER_MESSAGE };
+    return { kind: 'ready', identity, store, reconciled };
+}
+export function offlineWithoutRelayUrlMessage(reason) {
+    return `[Bridge] Could not reach the ftown server (${reason}) and no relay URL was saved by an earlier start. Check the connection and run \`ftown start\` again.`;
+}
+/**
+ * Step 5, the first relay token. A proven revocation (the token hooks offer the server's evidence first) wins over everything; a
+ * refusal (401/403) exits; a temporary failure (network, timeout, 5xx, cooldown) starts offline with the saved relay URL, and exits
+ * only when there is none. After a successful token the revocation is checked again: the token response's ledger may prove it.
+ */
+export async function startRelay(input) {
+    let token;
+    try {
+        token = await input.getToken();
+    }
+    catch (error) {
+        if (input.bridgeRevoked())
+            return { kind: 'revoked' };
+        if (isRefusal(error))
+            return { kind: 'exit', message: relayTokenFailureMessage(error, input.apiUrl) };
+        const reason = messageOf(error);
+        const relayUrl = input.relayUrl();
+        return relayUrl === null ? { kind: 'exit', message: offlineWithoutRelayUrlMessage(reason) } : { kind: 'offline', relayUrl, reason };
+    }
+    if (input.bridgeRevoked())
+        return { kind: 'revoked' };
+    const relayUrl = input.relayUrl();
+    if (relayUrl === null)
+        return { kind: 'exit', message: MISSING_RELAY_URL_MESSAGE };
+    return { kind: 'online', token, relayUrl };
+}
+export function endpointRefusedMessage(reason) {
+    return `[Bridge] The ftown server refused this computer's encrypted endpoint (${reason}). If it was removed from your account, run \`ftown start --new-identity\` to pair it again.`;
+}
+export function createEndpointRegistrar(deps) {
+    const schedule = deps.schedule ?? ((run, ms) => { const timer = setTimeout(run, ms); timer.unref(); return () => clearTimeout(timer); });
+    const maxDelay = deps.maxDelayMs ?? 600_000;
+    let delay = deps.baseDelayMs ?? 15_000;
+    let done = false;
+    let stopped = false;
+    let cancel = null;
+    const next = () => {
+        const wait = Math.max(deps.tokens.cooldownRemainingMs(), delay);
+        delay = Math.min(delay * 2, maxDelay);
+        cancel = schedule(() => { cancel = null; void attempt(); }, wait);
+    };
+    const attempt = async () => {
+        if (done || stopped)
+            return;
+        try {
+            await deps.register(await deps.tokens.getToken());
+            done = true;
+            deps.log('[Bridge] Registered this computer\'s encrypted endpoint.');
+        }
+        catch (error) {
+            if (stopped)
+                return;
+            if (isRefusal(error)) {
+                // A verified revocation restarts the bridge on its own; anything else needs the owner.
+                if (!deps.bridgeRevoked())
+                    deps.log(endpointRefusedMessage(messageOf(error)));
+                stopped = true;
+                return;
+            }
+            next();
+        }
+    };
+    return {
+        async registerNow(token) {
+            try {
+                await deps.register(token);
+                done = true;
+                return { kind: 'registered' };
+            }
+            catch (error) {
+                if (deps.bridgeRevoked())
+                    return { kind: 'revoked' };
+                if (isRefusal(error))
+                    return { kind: 'exit', message: endpointRefusedMessage(messageOf(error)) };
+                deps.log(`[Bridge] Could not register this computer's encrypted endpoint yet (${messageOf(error)}); retrying in the background.`);
+                return { kind: 'retry' };
+            }
+        },
+        retryInBackground() {
+            if (done || stopped || cancel !== null)
+                return;
+            next();
+        },
+        registered: () => done,
+        stop() {
+            stopped = true;
+            cancel?.();
+            cancel = null;
+        },
+    };
+}
+//# sourceMappingURL=ledger-startup.js.map

package/dist/ledger-startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-startup.js","sourceRoot":"","sources":["../src/ledger-startup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAsD,MAAM,qBAAqB,CAAC;AAE3I,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,kBAAkB,EAA6B,MAAM,sCAAsC,CAAC;AACxJ,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,yBAAyB,EAA8C,MAAM,mCAAmC,CAAC;AAE/J,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAEnG,MAAM,CAAC,MAAM,4BAA4B,GAAG,oHAAoH,CAAC;AACjK,MAAM,CAAC,MAAM,qBAAqB,GAAG,mGAAmG,CAAC;AACzI,MAAM,CAAC,MAAM,qBAAqB,GAAG,2DAA2D,CAAC;AACjG,MAAM,CAAC,MAAM,8BAA8B,GAAG,2JAA2J,CAAC;AAC1M,MAAM,CAAC,MAAM,+BAA+B,GAAG,qFAAqF,CAAC;AACrI,MAAM,CAAC,MAAM,yBAAyB,GAAG,4FAA4F,CAAC;AAEtI,iHAAiH;AACjH,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC;AAaD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuH,EACvH,OAAmC,EAAE;IAErC,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,IAAI,qBAAqB,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,4BAA4B,IAAI,4BAA4B,CAAC;IACnF,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,WAAW;YAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;aACjD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,aAAa;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YACrF,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YACxC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9D,CAAC;AAID,+HAA+H;AAC/H,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IAChD,OAAO,aAAa,CAAC;AACvB,CAAC;AA2BD,MAAM,SAAS,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAErG,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,OAAO,gEAAgE,MAAM,wDAAwD,CAAC;AACxI,CAAC;AAED,SAAS,KAAK,CAAC,QAAqC;IAClD,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAwB;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,IAAI,0BAA0B,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9F,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC;IAE7D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;QAC1F,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;QACnE,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,iBAAiB;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACvE,IAAI,IAAI,KAAK,kBAAkB;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;YACzF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3E,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,6BAA6B;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACxJ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IACnG,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7D,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACtF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AAUD,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,OAAO,8CAA8C,MAAM,uGAAuG,CAAC;AACrK,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAEhC;IACC,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IAAC,CAAC;IACvC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,aAAa,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtD,IAAI,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACtG,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,6BAA6B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACtI,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,yEAAyE,MAAM,8FAA8F,CAAC;AACvL,CAAC;AA0BD,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAe,EAAE,EAAU,EAAE,EAAE,GAAG,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7J,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC;IAC5C,IAAI,KAAK,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC;IACvC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAwB,IAAI,CAAC;IAEvC,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,KAAK,CAAC,CAAC;QAChE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,IAAI,IAAI,IAAI,OAAO;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClD,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,uFAAuF;gBACvF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;oBAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9E,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC3B,IAAI,GAAG,IAAI,CAAC;gBACZ,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,IAAI,CAAC,aAAa,EAAE;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;gBACrD,IAAI,SAAS,CAAC,KAAK,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjG,IAAI,CAAC,GAAG,CAAC,uEAAuE,SAAS,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBAClI,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,iBAAiB;YACf,IAAI,IAAI,IAAI,OAAO,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO;YAC/C,IAAI,EAAE,CAAC;QACT,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,EAAE,CAAC;YACX,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/relay-token.d.ts

@@ -0,0 +1,39 @@
+import { UnauthorizedError } from 'centrifuge';
+export interface RelayTokenFetcherDeps {
+    apiUrl: string;
+    accountId: () => string;
+    bridgeId: string;
+    authPrivateKey: CryptoKey;
+    /** Head of the locally trusted ledger, or null when there is none. */
+    head: () => string | null;
+    /** Called with a ledger returned by the server, BEFORE the token is handed back. */
+    onLedger: (ledger: unknown) => Promise<void>;
+    /** Called with the evidence ledger of a 401 key_revoked, BEFORE UnauthorizedError is thrown. */
+    onRevoked: (ledger: unknown) => Promise<void>;
+    fetchImpl?: typeof fetch;
+    /** Per-request timeout in ms (default 15000). */
+    timeoutMs?: number;
+    /** Presence info claim, as refreshBridgeToken sends today (os.hostname()). Omitted when undefined. */
+    hostname?: () => string;
+    /** Loopback port advert (discovery only). Omitted when undefined. */
+    localPort?: () => number | undefined;
+    /** On a plain 401 (not key_revoked): resolve true to retry the whole sequence exactly once. */
+    onUnauthorized?: () => Promise<boolean>;
+}
+/** A 401 key_revoked; still terminal for centrifuge-js. `ledger` is the (unverified) evidence. */
+export declare class RelayKeyRevokedError extends UnauthorizedError {
+    readonly ledger: unknown;
+    constructor(ledger: unknown);
+}
+export interface RelayToken {
+    token: string;
+    expiresAt: number;
+}
+/**
+ * Proves possession of the bridge auth key to the server and returns a relay (Centrifugo) token.
+ * Replaces the rotating refresh token: there is no credential to persist.
+ *
+ * A 401 is terminal (UnauthorizedError stops centrifuge-js retrying); everything else is a plain
+ * Error so the caller's backoff and cooldown apply.
+ */
+export declare function createRelayTokenFetcher(deps: RelayTokenFetcherDeps): () => Promise<RelayToken>;

package/dist/relay-token.js

@@ -0,0 +1,130 @@
+import { UnauthorizedError } from 'centrifuge';
+import { signAuthProof } from './security/ledger/proof.js';
+/** A 401 key_revoked; still terminal for centrifuge-js. `ledger` is the (unverified) evidence. */
+export class RelayKeyRevokedError extends UnauthorizedError {
+    ledger;
+    constructor(ledger) {
+        super('Bridge revoked');
+        this.name = 'RelayKeyRevokedError';
+        this.ledger = ledger;
+    }
+}
+const BODY_CAP = 200;
+const MAX_RESPONSE_BYTES = 3 * 1024 * 1024;
+const DEFAULT_TIMEOUT_MS = 15_000;
+function parseJson(text) {
+    try {
+        const value = JSON.parse(text);
+        return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function post(fetchImpl, url, body, timeoutMs) {
+    try {
+        const res = await fetchImpl(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        const declared = Number(res.headers.get('content-length'));
+        if (declared > MAX_RESPONSE_BYTES)
+            throw new Error('relay_token_response_too_large');
+        const text = await res.text();
+        if (text.length > MAX_RESPONSE_BYTES)
+            throw new Error('relay_token_response_too_large');
+        return { status: res.status, ok: res.ok, text };
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === 'relay_token_response_too_large')
+            throw error;
+        if (error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError')) {
+            throw new Error(`Relay request timed out after ${timeoutMs}ms`);
+        }
+        throw error;
+    }
+}
+class PlainUnauthorized extends UnauthorizedError {
+}
+function toUnauthorized(error) {
+    return error instanceof PlainUnauthorized ? new UnauthorizedError(error.message) : error;
+}
+/**
+ * Proves possession of the bridge auth key to the server and returns a relay (Centrifugo) token.
+ * Replaces the rotating refresh token: there is no credential to persist.
+ *
+ * A 401 is terminal (UnauthorizedError stops centrifuge-js retrying); everything else is a plain
+ * Error so the caller's backoff and cooldown apply.
+ */
+export function createRelayTokenFetcher(deps) {
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const apiUrl = deps.apiUrl.replace(/\/+$/, '');
+    const audience = new URL(apiUrl).origin;
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const presence = () => {
+        const out = {};
+        const hostname = deps.hostname?.();
+        if (hostname !== undefined)
+            out.hostname = hostname;
+        const localPort = deps.localPort?.();
+        if (localPort !== undefined)
+            out.localPort = localPort;
+        return out;
+    };
+    const attempt = async () => {
+        const nonceRes = await post(fetchImpl, `${apiUrl}/api/auth/nonce`, { purpose: 'relay' }, timeoutMs);
+        const nonceText = nonceRes.text;
+        if (!nonceRes.ok)
+            throw new Error(`Relay nonce failed (${nonceRes.status}): ${nonceText.slice(0, BODY_CAP)}`);
+        const nonce = parseJson(nonceText)?.nonce;
+        if (typeof nonce !== 'string' || nonce.length === 0)
+            throw new Error('Relay nonce response malformed');
+        const proof = await signAuthProof(deps.authPrivateKey, {
+            accountId: deps.accountId(),
+            kind: 'bridge',
+            keyId: deps.bridgeId,
+            nonce,
+            purpose: 'relay',
+            audience,
+        });
+        const res = await post(fetchImpl, `${apiUrl}/api/auth/relay-token`, { proof, head: deps.head(), ...presence() }, timeoutMs);
+        const text = res.text;
+        if (res.status === 401) {
+            const body = parseJson(text);
+            if (body && body.error === 'key_revoked' && body.ledger !== undefined) {
+                await deps.onRevoked(body.ledger);
+                throw new RelayKeyRevokedError(body.ledger);
+            }
+            throw new PlainUnauthorized(`Relay token rejected (401): ${text.slice(0, BODY_CAP)}`);
+        }
+        if (!res.ok)
+            throw new Error(`Relay token failed (${res.status}): ${text.slice(0, BODY_CAP)}`);
+        const body = parseJson(text);
+        if (!body || typeof body.token !== 'string' || !body.token || typeof body.expiresAt !== 'number') {
+            throw new Error('Relay token response malformed');
+        }
+        if (body.ledger !== undefined && body.ledger !== null)
+            await deps.onLedger(body.ledger);
+        return { token: body.token, expiresAt: body.expiresAt };
+    };
+    return async () => {
+        try {
+            return await attempt();
+        }
+        catch (error) {
+            if (!(error instanceof PlainUnauthorized) || !deps.onUnauthorized)
+                throw toUnauthorized(error);
+            if (!(await deps.onUnauthorized()))
+                throw toUnauthorized(error);
+            try {
+                return await attempt();
+            }
+            catch (retryError) {
+                throw toUnauthorized(retryError);
+            }
+        }
+    };
+}
+//# sourceMappingURL=relay-token.js.map

package/dist/relay-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-token.js","sourceRoot":"","sources":["../src/relay-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAwB3D,kGAAkG;AAClG,MAAM,OAAO,oBAAqB,SAAQ,iBAAiB;IAChD,MAAM,CAAU;IAEzB,YAAY,MAAe;QACzB,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAOD,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,SAAuB,EAAE,GAAW,EAAE,IAAa,EAAE,SAAiB;IACxF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC3D,IAAI,QAAQ,GAAG,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACxF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,gCAAgC;YAAE,MAAM,KAAK,CAAC;QAC9F,IAAI,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,iBAAkB,SAAQ,iBAAiB;CAAG;AAEpD,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAEvD,MAAM,QAAQ,GAAG,GAA8C,EAAE;QAC/D,MAAM,GAAG,GAA8C,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS;YAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QACrC,IAAI,SAAS,KAAK,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QACvD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,IAAyB,EAAE;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,iBAAiB,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;QACpG,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;QAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAEvG,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE;YACrD,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3B,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,IAAI,CAAC,QAAQ;YACpB,KAAK;YACL,OAAO,EAAE,OAAO;YAChB,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5H,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QAEtB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtE,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClC,MAAM,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE/F,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACjG,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxF,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC/F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBAAE,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/revocation-gating.d.ts

@@ -1,21 +1,8 @@
-import type { AccountCheckpoint } from './security/account-protocol.js';
 export type BridgeMode = 'account' | 'solo' | 'local';
 export declare function bridgeMode(opts: {
     local?: boolean;
     solo?: boolean;
 }): BridgeMode;
-/** Solo and local bridges belong to no account, so nothing can revoke them. */
-export declare function handlesRevocation(mode: BridgeMode): boolean;
-/** A pin that already tombstones this bridgeId is signed proof on its own. */
-export declare function restartForPinnedRevocation(mode: BridgeMode, pinned: AccountCheckpoint | null, bridgeId: string): boolean;
-/** Only a refusal whose signed history verifies against our own pin counts; a bare 401 or a forged body never does. */
-export declare function restartForRefreshError(input: {
-    mode: BridgeMode;
-    error: unknown;
-    pinned: AccountCheckpoint | null;
-    bridgeId: string;
-    now?: number;
-}): Promise<boolean>;
 /** Same phases as the update coordinator's active operation: the update reservation is held. */
 export declare function updateOperationActive(phase: string | null): boolean;
 /**

package/dist/revocation-gating.js

@@ -1,22 +1,6 @@
-import { BridgeRevokedError } from './bridge-auth.js';
-import { confirmOwnRevocation, isOwnBridgeRevoked } from './security/bridge/revocation.js';
 export function bridgeMode(opts) {
     return opts.local ? 'local' : opts.solo ? 'solo' : 'account';
 }
-/** Solo and local bridges belong to no account, so nothing can revoke them. */
-export function handlesRevocation(mode) {
-    return mode === 'account';
-}
-/** A pin that already tombstones this bridgeId is signed proof on its own. */
-export function restartForPinnedRevocation(mode, pinned, bridgeId) {
-    return handlesRevocation(mode) && isOwnBridgeRevoked(pinned, bridgeId);
-}
-/** Only a refusal whose signed history verifies against our own pin counts; a bare 401 or a forged body never does. */
-export async function restartForRefreshError(input) {
-    if (!handlesRevocation(input.mode) || !(input.error instanceof BridgeRevokedError))
-        return false;
-    return confirmOwnRevocation({ evidence: input.error.evidence, pinned: input.pinned, bridgeId: input.bridgeId, now: input.now });
-}
 const ACTIVE_UPDATE_PHASES = ['staging', 'prepared', 'restarting'];
 /** Same phases as the update coordinator's active operation: the update reservation is held. */
 export function updateOperationActive(phase) {

package/dist/revocation-gating.js.map

@@ -1 +1 @@
-{"version":3,"file":"revocation-gating.js","sourceRoot":"","sources":["../src/revocation-gating.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAI3F,MAAM,UAAU,UAAU,CAAC,IAAyC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,IAAgB;IAChD,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,0BAA0B,CAAC,IAAgB,EAAE,MAAgC,EAAE,QAAgB;IAC7G,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,uHAAuH;AACvH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA6G;IACxJ,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,kBAAkB,CAAC;QAAE,OAAO,KAAK,CAAC;IACjG,OAAO,oBAAoB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;AAClI,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AAEnE,gGAAgG;AAChG,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,KAAK,KAAK,IAAI,IAAI,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA6D;IACpG,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"revocation-gating.js","sourceRoot":"","sources":["../src/revocation-gating.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,UAAU,CAAC,IAAyC;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AAEnE,gGAAgG;AAChG,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,KAAK,KAAK,IAAI,IAAI,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA6D;IACpG,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC3E,CAAC"}

package/dist/security/bridge/identity.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import type { EndpointIdentity, EndpointKind } from '../protocol.js';
-import type { VerifiedAccountTrust } from '../account-protocol.js';
+/** Solo, --local and local-CLI endpoint keys (`<kind>-identity.json`); account bridges keep theirs in ledger-identity.json. */
 export declare const identityRecordSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     endpoint: z.ZodObject<{
@@ -8,8 +8,8 @@ export declare const identityRecordSchema: z.ZodObject<{
         id: z.ZodString;
         ownerId: z.ZodString;
         kind: z.ZodEnum<{
-            browser: "browser";
             bridge: "bridge";
+            browser: "browser";
             "local-cli": "local-cli";
         }>;
         publicKey: z.ZodString;
@@ -23,50 +23,6 @@ export declare const identityRecordSchema: z.ZodObject<{
         key_ops: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ext: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>;
-    accountBootstrap: z.ZodOptional<z.ZodObject<{
-        history: z.ZodCustom<import("../account-protocol.js").AccountHistory, import("../account-protocol.js").AccountHistory>;
-        checkpoint: z.ZodObject<{
-            version: z.ZodLiteral<1>;
-            ownerId: z.ZodString;
-            rootId: z.ZodString;
-            head: z.ZodString;
-            revision: z.ZodNumber;
-            devices: z.ZodArray<z.ZodObject<{
-                endpoint: z.ZodObject<{
-                    version: z.ZodLiteral<1>;
-                    id: z.ZodString;
-                    ownerId: z.ZodString;
-                    kind: z.ZodEnum<{
-                        browser: "browser";
-                        bridge: "bridge";
-                        "local-cli": "local-cli";
-                    }>;
-                    publicKey: z.ZodString;
-                }, z.core.$strict>;
-                signingPublicKey: z.ZodString;
-                label: z.ZodString;
-                approvedAt: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
-            }, z.core.$strict>>;
-            bridges: z.ZodArray<z.ZodObject<{
-                bridgeId: z.ZodString;
-                endpoint: z.ZodObject<{
-                    version: z.ZodLiteral<1>;
-                    id: z.ZodString;
-                    ownerId: z.ZodString;
-                    kind: z.ZodEnum<{
-                        browser: "browser";
-                        bridge: "bridge";
-                        "local-cli": "local-cli";
-                    }>;
-                    publicKey: z.ZodString;
-                }, z.core.$strict>;
-                label: z.ZodString;
-                approvedAt: z.ZodUnion<readonly [z.ZodISODateTime, z.ZodISODateTime]>;
-            }, z.core.$strict>>;
-            revokedDeviceIds: z.ZodArray<z.ZodString>;
-            revokedBridgeIds: z.ZodArray<z.ZodString>;
-        }, z.core.$strict>;
-    }, z.core.$strict>>;
 }, z.core.$strict>;
 /** OS-local persisted keys; corruption/wrong owner never silently generates a replacement identity. */
 export declare function loadOrCreateIdentity(dataDir: string, ownerId: string, kind: 'bridge' | 'local-cli'): Promise<EndpointIdentity>;
@@ -75,5 +31,4 @@ export declare function loadLocalIdentity(dataDir: string, ownerId: string): Pro
 /** Absence alone permits virgin onboarding; corruption must never generate a new key/root. */
 export declare function readBoundBridgeIdentity(dataDir: string): Promise<{
     identity: EndpointIdentity;
-    bootstrap?: VerifiedAccountTrust;
 } | null>;

package/dist/security/bridge/identity.js

@@ -5,11 +5,11 @@ import { generateEndpoint, importEndpoint } from '../crypto.js';
 import { endpointSchema } from './metadata.js';
 import { AtomicSnapshot } from './snapshot.js';
 import { BridgeSecurityError } from './errors.js';
-import { verifiedAccountSchema } from './account-state.js';
+/** Solo, --local and local-CLI endpoint keys (`<kind>-identity.json`); account bridges keep theirs in ledger-identity.json. */
 export const identityRecordSchema = z.object({ version: z.literal(1), endpoint: endpointSchema, privateKey: z.object({
         kty: z.literal('EC'), crv: z.literal('P-256'), x: z.string(), y: z.string(), d: z.string(),
         key_ops: z.array(z.string()).optional(), ext: z.boolean().optional(),
-    }).strict(), accountBootstrap: verifiedAccountSchema.optional() }).strict();
+    }).strict() }).strict();
 /** OS-local persisted keys; corruption/wrong owner never silently generates a replacement identity. */
 export async function loadOrCreateIdentity(dataDir, ownerId, kind) {
     const generated = await generateEndpoint(ownerId, kind, true);
@@ -55,7 +55,7 @@ export async function readBoundBridgeIdentity(dataDir) {
         const record = identityRecordSchema.parse(JSON.parse(raw));
         if (record.endpoint.kind !== 'bridge')
             throw new BridgeSecurityError('wrong_context');
-        return { identity: await importEndpoint(record.endpoint, record.privateKey, false), bootstrap: record.accountBootstrap };
+        return { identity: await importEndpoint(record.endpoint, record.privateKey, false) };
     }
     catch {
         throw new BridgeSecurityError('key_unavailable');

package/dist/security/bridge/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/security/bridge/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnH,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACrE,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAE5E,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,OAAe,EAAE,IAA4B;IACvG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,gBAAgB,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QAAC,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAC7E,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAkB,IAAoC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;AAE7I,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAe;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACnI,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAClH,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACxF,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC3H,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/security/bridge/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,+HAA+H;AAC/H,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnH,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QAC1F,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACrE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAExB,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,OAAe,EAAE,IAA4B;IACvG,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1G,MAAM,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,gBAAgB,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACvH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QAAC,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAC7E,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAkB,IAAoC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;AAE7I,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAe;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACnI,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAClH,OAAO,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IACxF,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AAC/D,CAAC"}

package/dist/security/bridge/ledger-identity.d.ts

@@ -0,0 +1,48 @@
+import type { EndpointPublic } from '../protocol.js';
+export interface LedgerBridgeIdentity {
+    /** ECDH P-256 endpoint key pair for HPKE; the private key is non-extractable. */
+    keyPair: CryptoKeyPair;
+    /** Raw uncompressed ECDH point, base64url: BridgePairRequest.endpointPublicKey. */
+    endpointPublicKey: string;
+    /** base64url SHA-256 of the raw endpoint point: EndpointPublic.id. */
+    endpointId: string;
+    /** Raw uncompressed ECDSA point, base64url: BridgePairRequest/LedgerBridge.authPublicKey. */
+    authPublicKey: string;
+    /** Non-extractable ECDSA P-256 signing key for signAuthProof. */
+    authPrivateKey: CryptoKey;
+    /** The bound endpoint, or null before pairing. With `keyPair` it is the bridge's EndpointIdentity. */
+    endpoint: EndpointPublic | null;
+    /** endpoint.ownerId once bound, else null. */
+    accountId: string | null;
+}
+/** What is on disk, without importing keys. A corrupted file throws BridgeSecurityError('key_unavailable'). */
+export type LedgerIdentityFileInfo = {
+    state: 'absent';
+    accountId: null;
+} | {
+    state: 'ready';
+    accountId: string | null;
+};
+/** Reports the v2 identity file's state without importing keys. Throws BridgeSecurityError('key_unavailable') for a corrupted file. */
+export declare function inspectIdentityFile(dataDir: string): Promise<LedgerIdentityFileInfo>;
+/**
+ * True iff the data dir holds v1 ACCOUNT state: `refresh-token`, `security/account-enrollment.json`,
+ * `security/pending-approval-status.json` or `security/pending-approval-confirmation.json` exists, or `security/bridge-identity.json`
+ * has a readable endpoint owner that is not `solo:` (Solo's identity is never reported). An unreadable bridge-identity.json is not
+ * reported: its owner cannot be told apart from Solo's. Reads only; never modifies anything.
+ */
+export declare function hasLegacyAccountState(dataDir: string): boolean;
+/** Loads the identity without creating one: null when absent. Throws BridgeSecurityError('key_unavailable') for a corrupted file. */
+export declare function readLedgerIdentity(dataDir: string): Promise<LedgerBridgeIdentity | null>;
+/**
+ * Loads the identity, creating fresh keys only when the file is absent. Throws BridgeSecurityError: key_unavailable for an unreadable
+ * or corrupted file (never replaced), storage_unavailable when the new file cannot be written.
+ */
+export declare function loadOrCreateLedgerIdentity(dataDir: string): Promise<LedgerBridgeIdentity>;
+/**
+ * Binds the identity to `accountId` once: sets endpoint {version:1, id, ownerId: accountId, kind:'bridge', publicKey}. Idempotent for
+ * the same account. Throws BridgeSecurityError: wrong_context for a different (or malformed) accountId, key_unavailable when there is
+ * no valid identity to bind, storage_unavailable when the file cannot be written. Binds are serialized within this process only: the
+ * bridge's single-instance guarantee keeps a second process from binding concurrently.
+ */
+export declare function bindLedgerIdentity(dataDir: string, accountId: string): Promise<LedgerBridgeIdentity>;