ftown 0.20.9 → 0.24.0

package/dist/security/bridge/security.js

@@ -5,10 +5,9 @@ import { BridgePolicyStore } from './policy.js';
 import { BridgeSecurityError } from './errors.js';
 import { classifyCommand, classifyHttp, classifyTerminal } from './permissions.js';
 import { endpointSchema } from './metadata.js';
-import { ACCOUNT_TRUST_LIMITS, AccountTrustError } from '../account-crypto.js';
-import { AccountReadUnavailable } from './account-client.js';
-import { AccountBridgeRevoked, confirmOwnRevocation, isOwnBridgeRevoked } from './revocation.js';
-import { ACCOUNT_SAFETY_REFRESH_MS, SECURITY_NUDGE_MIN_SPACING_MS, createCoalescedTrigger } from '../security-nudge.js';
+import { accountIdOf, ledgerHead, ledgerHeads, parseLedger, relateHead } from '../ledger/ledger.js';
+import { verifyHeadAnnouncement } from '../ledger/announce.js';
+import { ledgerRemovesBridge, shortHead } from './ledger-store.js';
 const token = z.string().regex(/^[A-Za-z0-9_-]{1,200}$/);
 const routeSchema = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('command'), requestId: token, command: z.string().min(1).max(100), sessionId: token.nullable() }).strict(),
@@ -22,8 +21,24 @@ const object = (value) => {
     return value;
 };
 export const applicationJson = (value) => JSON.parse(JSON.stringify(value));
-const ACCOUNT_READ_RETRY_BASE_MS = 60_000;
-const ACCOUNT_READ_RETRY_MAX_MS = 1_800_000;
+/** onApprovalRequired: at most one emission per endpoint per spacing, and at most this many endpoints tracked at once. */
+const APPROVAL_SPACING_MS = 2000;
+const APPROVAL_TRACKED_LIMIT = 1024;
+const REJECTED = { decision: 'reject', relation: null, head: null, revision: null };
+const reason = (error) => error instanceof Error ? error.message : String(error);
+const httpStatus = (error) => typeof error === 'object' && error !== null && 'status' in error && typeof error.status === 'number' ? error.status : null;
+/** The candidate's last record ({revision, head}), or null when it is not a well-formed chain. One hash, no signature work. */
+async function chainTip(candidate) {
+    try {
+        const ledger = parseLedger(candidate);
+        const last = ledger.transitions[ledger.transitions.length - 1];
+        return { revision: ledger.transitions.length, head: last === undefined ? await accountIdOf(ledger.genesis.payload) : await ledgerHead(last.payload) };
+    }
+    catch {
+        return null;
+    }
+}
+// adoptAccount is v1 (removed from this service); the shared interface drops it in the v1 cleanup.
 export class BridgeSecurityService {
     identity;
     bridgeId;
@@ -39,20 +54,42 @@ export class BridgeSecurityService {
     bridgeRevokedEmitted = false;
     verified = new WeakSet();
     closed = false;
-    accountTimer = null;
-    accountTimerDue = 0;
-    accountPushHealthy = false;
-    accountReadFailures = 0;
-    accountRefresh = null;
-    accountTrigger = null;
-    accountAbort = new AbortController();
+    ledgerNow;
+    /** Ledger offers and their projections run one at a time, so the policy never sees an older view after a newer one. */
+    ledgerTail = Promise.resolve();
+    status = {
+        accountId: null, revision: null, head: null, own: 'unpaired', divergence: null, serverBehind: false, removedOnOtherHistory: false,
+    };
+    announcements = { accepted: 0, dropped: 0 };
+    headListeners = new Set();
+    ledgerMonotonic;
+    /** The trusted view of the last projection (null: none yet, or another account's). */
+    trustedView = null;
+    /** The state of the last projection (null: none yet, or an empty store), and the record heads of its chain (null: not computed). */
+    held = null;
+    heads = null;
+    approvalListeners = new Set();
+    approvalEmitted = new Map();
+    pendingOffers = new Map();
+    serverBehind = false;
+    /** The server's revision when it was last seen behind us (null: unknown). */
+    serverRevision = null;
+    refreshing = null;
+    refreshQueued = null;
     constructor(identity, bridgeId, dataDir, options) {
         this.identity = identity;
         this.bridgeId = bridgeId;
         this.options = options;
         this.endpoint = identity.endpoint;
         this.now = options.now ?? Date.now;
+        this.ledgerNow = options.ledger?.now ?? this.now;
+        this.ledgerMonotonic = options.ledger?.monotonic ?? (() => performance.now());
         this.policy = new BridgePolicyStore(dataDir, bridgeId, this.endpoint, options);
+        if (options.ledger) {
+            if (options.ledger.bridgeId !== bridgeId)
+                throw new BridgeSecurityError('wrong_context');
+            this.policy.enableLedger(this.ledgerNow, this.ledgerMonotonic);
+        }
     }
     context(route) {
         if (this.closed || route.bridgeId !== this.bridgeId)
@@ -121,7 +158,7 @@ export class BridgeSecurityService {
         if (envelope.purpose !== 'hello')
             throw new BridgeSecurityError('wrong_context');
         this.freshness(envelope, false);
-        const principal = await this.policy.principal(envelope.senderId);
+        const principal = await this.senderPrincipal(envelope.senderId);
         const hello = z.object({ type: z.literal('hello'), challenge: token }).strict().parse(await this.decode(principal.endpoint, envelope, route));
         const welcome = await this.reply(principal.endpoint, 'welcome', { type: 'welcome', challenge: hello.challenge, receiverEpoch: this.receiverEpoch }, route, envelope.messageId);
         const current = await this.policy.principal(principal.endpoint.id);
@@ -174,7 +211,7 @@ export class BridgeSecurityService {
         const envelope = parseSecureEnvelope(packet);
         if (envelope.purpose !== 'application')
             throw new BridgeSecurityError('wrong_context');
-        const principal = await this.policy.principal(envelope.senderId);
+        const principal = await this.senderPrincipal(envelope.senderId);
         const app = this.parseApplication(await this.decode(principal.endpoint, envelope, route));
         if (app.route.kind === 'http') {
             const data = object(app.data);
@@ -229,7 +266,7 @@ export class BridgeSecurityService {
                 packets.push(await this.sealTo(recipient.endpoint.id, application, { transport: 'cloud', channel, bridgeId: this.bridgeId, pairId: null }));
             }
             catch (error) {
-                if (!(error instanceof BridgeSecurityError) || (!['endpoint_revoked', 'approval_required', 'expired', 'invalid_account_trust'].includes(error.code)
+                if (!(error instanceof BridgeSecurityError) || (!['endpoint_revoked', 'approval_required', 'expired'].includes(error.code)
                     && !error.code.startsWith('account_')))
                     throw error;
             }
@@ -243,117 +280,367 @@ export class BridgeSecurityService {
         for (const listener of this.revoked)
             listener(endpointId);
     }
-    /** Called once at startup; legacy/Solo stores never adopt an unsigned server directory. */
-    async startAccount(trust) {
-        // A pin that already tombstones this bridge is signed proof on its own; no read can undo it.
-        if (isOwnBridgeRevoked(await this.pinnedCheckpoint(), this.bridgeId)) {
-            this.emitBridgeRevoked();
+    /**
+     * Account mode only (no-op without a ledger). Loads the replica, projects it and checks this bridge's own status; a stored chain that
+     * already revokes this bridge is signed proof on its own, so it emits and nothing is fetched. Otherwise offers the server's ledger
+     * once; a fetch failure is logged, not fatal, and a successful read that is not rejected counts as server contact.
+     * Throws when the local replica cannot be read (corrupted, another account's, or unreadable; it is never reset) or the policy
+     * cannot be written.
+     */
+    async startLedger() {
+        const ledger = this.options.ledger;
+        if (!ledger)
             return;
+        const own = await this.ledgerTask(async () => {
+            if (this.closed)
+                return null;
+            const state = await ledger.store.read();
+            return state === null ? this.project(null, null) : this.projectState(state);
+        });
+        if (own === null || own === 'revoked' || this.closed)
+            return;
+        await this.refreshLedger();
+    }
+    /**
+     * Reads the server's ledger and offers it ('server') through readServerLedger. A result that is not 'reject' counts as server contact;
+     * a fetch failure is logged, never thrown. Single in flight: calls during a read share one trailing read, so a change announced
+     * mid-read is not missed. The wiring calls it on every relay (re)subscribe and on a `ledger_head` that differs from ledgerStatus().head,
+     * and checks ledgerStatus().serverBehind afterwards.
+     */
+    refreshLedger() {
+        if (!this.options.ledger || this.closed)
+            return Promise.resolve();
+        if (this.refreshing) {
+            this.refreshQueued ??= this.refreshing.then(() => { this.refreshQueued = null; return this.refreshLedger(); });
+            return this.refreshQueued;
         }
-        if (trust)
-            await this.policy.pinBootstrap(trust);
-        this.recordAccountRead(await this.refreshAccount().then(() => true, () => false));
-        if (!this.closed && !this.accountTimer && this.options.readAccountHistory)
-            this.scheduleAccountRead();
-    }
-    recordAccountRead(ok) {
-        this.accountReadFailures = ok ? 0 : this.accountReadFailures + 1;
-    }
-    /** After failures the server is the only writer of account state, so retrying fast buys nothing: back off with jitter. */
-    nextAccountReadDelay() {
-        if (this.accountReadFailures > 0) {
-            const base = Math.min(ACCOUNT_READ_RETRY_BASE_MS * 2 ** (this.accountReadFailures - 1), ACCOUNT_READ_RETRY_MAX_MS);
-            return base * (0.8 + 0.4 * (this.options.random ?? Math.random)());
+        this.refreshing = this.refreshOnce().finally(() => { this.refreshing = null; });
+        return this.refreshing;
+    }
+    async refreshOnce() {
+        const read = await this.readServerLedger();
+        if (read.kind !== 'read')
+            console.warn('[Security] Account ledger read failed:', read.reason);
+    }
+    /**
+     * One read of the server's ledger (not coalesced), offered as 'server'; a result that is not 'reject' counts as server contact. Never
+     * throws: a 404 is 'unknown_account' (the server does not know this account), any other failure 'failed'. The re-offer runs it right
+     * before it posts; refreshLedger runs it for everything else.
+     */
+    async readServerLedger() {
+        const ledger = this.options.ledger;
+        if (!ledger || this.closed)
+            return { kind: 'failed', reason: 'Account ledger unavailable' };
+        let fetched;
+        try {
+            fetched = await ledger.fetchLedger();
         }
-        return this.accountPushHealthy ? ACCOUNT_SAFETY_REFRESH_MS : ACCOUNT_TRUST_LIMITS.refreshIntervalMs;
-    }
-    /** Safety read: 1 h while push is healthy and the last read succeeded, else the 10 min cadence; failed reads back off from 60 s to 30 min. */
-    scheduleAccountRead(delay = this.nextAccountReadDelay()) {
-        if (this.closed || this.bridgeRevokedEmitted || !this.options.readAccountHistory)
-            return;
-        if (this.accountTimer)
-            clearTimeout(this.accountTimer);
-        this.accountTimerDue = performance.now() + delay; // monotonic: wall-clock steps and sleep must not skew the pull-in
-        this.accountTimer = setTimeout(() => { this.accountTimer = null; void this.trackedAccountRead(); }, delay);
-        this.accountTimer.unref();
-    }
-    async trackedAccountRead() {
+        catch (error) {
+            return httpStatus(error) === 404 ? { kind: 'unknown_account', reason: reason(error) } : { kind: 'failed', reason: reason(error) };
+        }
+        const outcome = await this.offerLedgerResult(fetched, 'server');
+        if (outcome.decision !== 'reject')
+            this.noteServerContact();
+        return { kind: 'read', outcome };
+    }
+    /** offerLedgerResult(candidate, source).decision. */
+    async offerLedger(candidate, source) {
+        return (await this.offerLedgerResult(candidate, source)).decision;
+    }
+    /**
+     * Offers an untrusted chain (the relay, a relay-token response, a server read or answer) to the replica, then projects the result and
+     * checks this bridge's own status. Never throws: an invalid candidate, a closed service and a local storage failure all return 'reject'.
+     * Per source at most one offer waits behind the one in flight; a newer one replaces it, and the replaced caller gets the newer outcome.
+     * A chain equal to the stored one or a prefix of it is answered keep/same or keep/behind from record heads alone (no signature check),
+     * unless a divergence is recorded for that source (the store clears it). The outcome of a 'server' chain sets serverBehind. Offers never
+     * count as server contact: readServerLedger and noteServerContact decide that.
+     */
+    offerLedgerResult(candidate, source) {
+        if (!this.options.ledger || this.closed)
+            return Promise.resolve(REJECTED);
+        return new Promise(resolve => {
+            const waiting = this.pendingOffers.get(source);
+            if (waiting) {
+                waiting.candidate = candidate;
+                waiting.waiters.push(resolve);
+                return;
+            }
+            const pending = { candidate, waiters: [resolve] };
+            this.pendingOffers.set(source, pending);
+            void this.ledgerTask(async () => {
+                if (this.pendingOffers.get(source) === pending)
+                    this.pendingOffers.delete(source);
+                return this.evaluate(pending.candidate, source);
+            }).catch(() => REJECTED).then(outcome => { for (const waiter of pending.waiters)
+                waiter({ ...outcome }); });
+        });
+    }
+    async evaluate(candidate, source) {
+        const ledger = this.options.ledger;
+        if (this.closed)
+            return REJECTED;
+        const tip = await chainTip(candidate);
+        const heads = this.heads;
+        if (tip !== null && heads !== null && this.held !== null && heads.of === this.held.checkpoint.head
+            && !this.held.divergences.some(entry => entry.source === source)) {
+            let known = 'unknown';
+            try {
+                known = relateHead(heads.list, tip);
+            }
+            catch { /* not a head of ours */ }
+            if (known === 'same' || known === 'behind')
+                return this.observed(source, { decision: 'keep', relation: known, head: tip.head, revision: tip.revision });
+        }
+        let result;
         try {
-            await this.refreshAccount();
-            this.recordAccountRead(true);
+            result = await ledger.store.offer(candidate, source);
         }
-        catch {
-            this.recordAccountRead(false);
+        catch (error) {
+            console.error('[Security] Account ledger offer failed:', reason(error));
+            return REJECTED;
         }
-        this.scheduleAccountRead();
-    }
-    /** Push (nudge subscription) health; losing it pulls the next safety read in to the 10 min cadence. */
-    setAccountPushHealthy(healthy) {
-        const lost = this.accountPushHealthy && !healthy;
-        this.accountPushHealthy = healthy;
-        if (lost && this.accountTimer && this.accountTimerDue - performance.now() > ACCOUNT_TRUST_LIMITS.refreshIntervalMs) {
-            this.scheduleAccountRead(ACCOUNT_TRUST_LIMITS.refreshIntervalMs);
+        const outcome = { decision: result.decision, relation: result.relation, head: result.candidate?.head ?? null, revision: result.candidate?.revision ?? null };
+        if (result.decision === 'reject' || result.state === null)
+            return { ...outcome, decision: 'reject' };
+        try {
+            await this.projectState(result.state);
+        }
+        catch (error) {
+            console.error('[Security] Account ledger projection failed:', reason(error));
         }
+        return this.observed(source, outcome);
+    }
+    /** Records what a non-rejected 'server' chain says about the server: behind (a strict prefix of ours) or not. */
+    observed(source, outcome) {
+        if (source === 'server' && outcome.decision !== 'reject')
+            this.setServerBehind(outcome.relation === 'behind', outcome.revision);
+        return outcome;
+    }
+    setServerBehind(behind, revision) {
+        this.serverBehind = behind;
+        this.serverRevision = behind ? revision : null;
+        this.status = { ...this.status, serverBehind: behind };
+    }
+    /**
+     * A relay-token answer that carried no chain: the server's head is `head` (at `revision` when the answer named one, else the head the
+     * request sent). Classified against the stored chain from record heads alone: 'same', 'behind' (sets serverBehind), or 'unknown'
+     * (ahead, diverged, or not a head of ours: the caller reads the server). null without a ledger, a head, or a stored chain.
+     */
+    noteServerHead(server) {
+        const heads = this.heads;
+        if (!this.options.ledger || this.closed || server.head === null || heads === null)
+            return null;
+        const revision = server.revision ?? heads.list.lastIndexOf(server.head);
+        let relation = 'unknown';
+        if (revision >= 0) {
+            try {
+                relation = relateHead(heads.list, { revision, head: server.head });
+            }
+            catch {
+                return null;
+            }
+        }
+        if (relation !== 'unknown')
+            this.setServerBehind(relation === 'behind', revision);
+        return relation;
+    }
+    /**
+     * What this bridge holds that the server does not (for the startup message when the server refuses our key): our records after the
+     * fork point of a recorded server divergence, or after the server's revision when it was seen behind us; null when neither is known.
+     */
+    uniqueHistory() {
+        const held = this.held;
+        if (held === null)
+            return null;
+        const fork = held.divergences.find(entry => entry.source === 'server')?.forkRevision ?? null;
+        const after = fork ?? (this.serverBehind ? this.serverRevision : null);
+        if (after === null || after < 0 || after > held.ledger.transitions.length)
+            return null;
+        const records = held.ledger.transitions.slice(after);
+        let removals = 0;
+        let passkeys = 0;
+        for (const record of records) {
+            const type = record.payload.operation.type;
+            if (type === 'revoke_device' || type === 'revoke_bridge')
+                removals++;
+            if (type === 'add_authority')
+                passkeys++;
+        }
+        return { afterRevision: after, records: records.length, removals, passkeys };
+    }
+    /**
+     * Account mode, read-only (ledger_head / ledger_chain): the stored chain, for a BROWSER that is a member of this bridge's trusted
+     * checkpoint (listed with exactly this endpoint key, not revoked; policy access, offline grace and own status included). Throws
+     * BridgeSecurityError('permission_denied') for anyone else, Solo, --local and the local CLI.
+     */
+    async memberLedger(principal) {
+        const held = await this.memberState(principal);
+        // Read-only by contract (the ledger_chain pager copies only the records it returns): no copy of the whole chain per request.
+        return { ledger: held.ledger, accountId: held.checkpoint.accountId, head: held.checkpoint.head, revision: held.checkpoint.revision };
+    }
+    /** ledger_head: like memberLedger, but answers the tip only, without touching the chain. */
+    async memberHead(principal) {
+        const held = await this.memberState(principal);
+        return { accountId: held.checkpoint.accountId, head: held.checkpoint.head, revision: held.checkpoint.revision };
+    }
+    async memberState(principal) {
+        if (!this.options.ledger || this.closed)
+            throw new BridgeSecurityError('permission_denied');
+        await this.policy.revalidate(principal, 'read');
+        const held = this.held;
+        const endpoint = principal.endpoint;
+        // The trusted checkpoint (sticky applied): a browser removed on a refused history is refused here too.
+        if (held === null || endpoint.kind !== 'browser' || held.trusted.accountId !== this.endpoint.ownerId
+            || held.trusted.revokedDeviceIds.includes(endpoint.id)
+            || !held.trusted.devices.some(device => device.endpoint.id === endpoint.id && device.endpoint.publicKey === endpoint.publicKey)) {
+            throw new BridgeSecurityError('permission_denied');
+        }
+        return held;
     }
-    /** Push-driven re-read (account nudge); bursts coalesce into at most one trailing read. */
-    requestAccountRefresh() {
-        if (this.closed || this.bridgeRevokedEmitted || !this.options.readAccountHistory)
+    /** A successful server contact (the token provider calls this after a relay-token response): re-anchors offline grace at now and
+     *  persists it (the replica's lastServerReadAt and the clock high-water). An invalid time is ignored. */
+    noteServerContact(now) {
+        const ledger = this.options.ledger;
+        if (!ledger || this.closed)
             return;
-        this.accountTrigger ??= createCoalescedTrigger(async () => {
-            // An in-flight read may predate the change, so it never satisfies a request.
-            await this.accountRefresh?.catch(() => undefined);
-            if (!this.closed)
-                await this.trackedAccountRead();
-        }, SECURITY_NUDGE_MIN_SPACING_MS);
-        this.accountTrigger.request();
-    }
-    accountFailure(error) {
-        return error instanceof BridgeSecurityError ? error : new BridgeSecurityError(error instanceof AccountTrustError ? error.code : 'invalid_account_trust');
-    }
-    emitRevoked(endpointIds) {
-        for (const id of endpointIds)
-            for (const listener of this.revoked)
-                listener(id);
-    }
-    async pinnedCheckpoint() {
+        const at = this.policy.noteServerRead(now ?? this.ledgerNow());
+        if (at === null)
+            return;
+        const failed = (error) => console.error('[Security] Recording server contact failed:', reason(error));
+        ledger.store.markServerRead(at).catch(failed);
+        this.policy.persistLedgerClock().catch(failed);
+    }
+    ledgerStatus() {
+        return { ...this.status, divergence: this.status.divergence === null ? null : { ...this.status.divergence }, announcements: { ...this.announcements } };
+    }
+    /**
+     * A head announcement from the ledger channel (parsed, from an owner publication), judged against this bridge's TRUSTED checkpoint (sticky
+     * revocations applied) and the record heads of its stored chain: its relation ('same', 'behind' or 'unknown': the caller runs a paced server
+     * read) when it verifies, else null. This bridge's own announcements (kind bridge, its bridgeId) return null before any work and are not
+     * counted; every other null is counted as dropped, every relation as accepted. At most one signature verification, then an O(1) compare.
+     * Never throws. An announcement is never proof: nothing here changes the replica.
+     */
+    async judgeHeadAnnouncement(announcement) {
+        if (!this.options.ledger || this.closed)
+            return null;
+        let relation = null;
         try {
-            return (await this.policy.accountTrust())?.checkpoint ?? null;
+            if (announcement.kind === 'bridge' && announcement.keyId === this.bridgeId)
+                return null;
+            const trusted = this.trustedView;
+            if (trusted !== null && this.heads !== null && this.heads.of === trusted.head
+                && await verifyHeadAnnouncement(trusted, announcement, this.ledgerNow())) {
+                // The chain may have moved during the verification: compare with the heads held now.
+                const heads = this.heads;
+                if (heads !== null)
+                    relation = relateHead(heads.list, { revision: announcement.revision, head: announcement.head });
+            }
         }
         catch {
-            return null;
+            relation = null;
         }
-    }
-    /** A refused fetched history is still evidence, but only against the pin as it stands now: adoption is not serialized
-     *  with reads, and a fork from an older pin must never confirm. Pins only move forward by verified extension. */
-    async adoptFetched(fetched, adopt) {
-        let adopted;
-        try {
-            adopted = await adopt();
+        if (relation === null)
+            this.announcements.dropped++;
+        else
+            this.announcements.accepted++;
+        return relation;
+    }
+    /** Account mode: fires (synchronously, after the projection) whenever the stored head or this bridge's own status changes, e.g. after an
+     *  adopt. Listener errors are logged. */
+    onLedgerHead(listener) {
+        this.headListeners.add(listener);
+        return () => { this.headListeners.delete(listener); };
+    }
+    ledgerTask(run) {
+        const next = this.ledgerTail.then(run);
+        this.ledgerTail = next.catch(() => undefined);
+        return next;
+    }
+    /** This bridge's keys, exactly as its add_bridge lists them. */
+    ownKeys() {
+        return { bridgeId: this.bridgeId, endpointId: this.endpoint.id, endpointPublicKey: this.endpoint.publicKey, authPublicKey: this.options.ledger?.authPublicKey ?? '' };
+    }
+    /**
+     * This bridge in `trusted` (applyRevocations of the projected RAW chain `ledger`). 'active' = listed with exactly its keys. 'revoked' =
+     * the RAW chain proves the removal of THIS bridge (ledgerRemovesBridge: it added these keys, then revoked the id), the only status that
+     * resets the identity, decided exactly like the startup check (store.ownBridgeStatus). A sticky-only id, a removal seen on a refused
+     * history (C1c `seen`, never merged for our own id anyway) or a tombstone of our id is 'absent': fail closed, never a reset.
+     */
+    ownOf(trusted, ledger) {
+        if (trusted === null)
+            return 'unpaired';
+        if (trusted.accountId !== this.endpoint.ownerId)
+            return 'absent';
+        const own = this.ownKeys();
+        if (trusted.bridges.some(item => item.bridgeId === own.bridgeId && item.authPublicKey === own.authPublicKey && item.endpoint.id === own.endpointId
+            && item.endpoint.publicKey === own.endpointPublicKey))
+            return 'active';
+        return ledger !== null && ledgerRemovesBridge(ledger, own) ? 'revoked' : 'absent';
+    }
+    /** `trusted` is always the store's applyRevocations output, never its raw checkpoint. Own status acts before the policy write, so
+     *  neither the revocation nor its emission waits on (or is lost to) a policy storage failure. */
+    async projectState(state) {
+        // The stored chain's record heads let an echo of it (or of a prefix) be answered without verification.
+        if (this.heads === null || this.heads.of !== state.checkpoint.head) {
+            try {
+                this.heads = { of: state.checkpoint.head, list: await ledgerHeads(state.ledger) };
+            }
+            catch {
+                this.heads = null;
+            }
         }
-        catch (error) {
-            if (!this.bridgeRevokedEmitted)
-                await this.confirmRevocationEvidence(fetched);
-            throw error;
+        this.held = state;
+        return this.project(state.trusted, state.lastServerReadAt, state.divergences, state.ledger);
+    }
+    async project(trusted, lastServerReadAt, divergences = [], ledger = null) {
+        const own = this.ownOf(trusted, ledger);
+        this.trustedView = trusted !== null && trusted.accountId === this.endpoint.ownerId ? trusted : null;
+        if (trusted === null) {
+            this.held = null;
+            this.heads = null;
         }
-        if (!this.bridgeRevokedEmitted && isOwnBridgeRevoked(await this.pinnedCheckpoint(), this.bridgeId))
+        const projection = this.policy.projectLedger({ trusted, own, lastServerReadAt });
+        const previous = this.status.own;
+        const previousHead = this.status.head;
+        // Server first: a server holding another history matters more than a relay publisher that does.
+        const shown = divergences.find(entry => entry.source === 'server') ?? divergences[0];
+        const divergence = shown === undefined || trusted === null ? null : {
+            source: shown.source, otherHead: shortHead(shown.otherHead), otherRevision: shown.otherRevision, ourRevision: trusted.revision, firstSeen: shown.firstSeen,
+            forkRevision: shown.forkRevision, removedOnOtherHistory: shown.removedOnOtherHistory,
+        };
+        this.status = {
+            accountId: trusted?.accountId ?? null, revision: trusted?.revision ?? null, head: trusted?.head ?? null, own, divergence, serverBehind: this.serverBehind,
+            removedOnOtherHistory: trusted !== null && divergences.some(entry => entry.removedOnOtherHistory),
+        };
+        if (own === 'revoked')
             this.emitBridgeRevoked();
-        return adopted;
+        // Not listed is not a signed revocation: fail closed and say so, but never reset the identity on it.
+        else if (own === 'absent' && previous !== 'absent')
+            console.warn('[Security] This bridge is not in its account ledger; account devices are refused.');
+        if (own !== previous || this.status.head !== previousHead)
+            this.emitLedgerHead();
+        this.emitRevoked(await projection);
+        return own;
+    }
+    emitLedgerHead() {
+        for (const listener of Array.from(this.headListeners)) {
+            try {
+                listener();
+            }
+            catch (error) {
+                console.error('[Security] ledgerHead listener failed:', error);
+            }
+        }
     }
-    async confirmRevocationEvidence(evidence) {
-        const confirmed = await confirmOwnRevocation({ evidence, pinned: await this.pinnedCheckpoint(), bridgeId: this.bridgeId, now: this.now() });
-        if (confirmed)
-            this.emitBridgeRevoked();
-        return confirmed;
+    emitRevoked(endpointIds) {
+        for (const id of endpointIds)
+            for (const listener of this.revoked)
+                listener(id);
     }
     emitBridgeRevoked() {
         if (this.bridgeRevokedEmitted)
             return;
         this.bridgeRevokedEmitted = true;
-        if (this.accountTimer)
-            clearTimeout(this.accountTimer);
-        this.accountTimer = null;
-        this.accountTrigger?.dispose();
-        this.accountTrigger = null;
         for (const listener of Array.from(this.bridgeRevokedListeners))
             this.notifyBridgeRevoked(listener);
     }
@@ -371,65 +658,53 @@ export class BridgeSecurityService {
             failed(error);
         }
     }
-    async refreshAccount() {
-        if (this.accountRefresh)
-            return this.accountRefresh;
-        const run = async () => {
-            if (this.closed || this.bridgeRevokedEmitted || !await this.policy.accountTrust())
-                return;
-            try {
-                if (!this.options.readAccountHistory)
-                    throw new AccountReadUnavailable();
-                const history = await this.options.readAccountHistory(this.accountAbort.signal);
-                if (!history)
-                    throw new BridgeSecurityError('account_trust_rollback');
-                if (this.closed)
-                    return;
-                const result = await this.adoptFetched(history, () => this.policy.applyAccountRead(history));
-                this.emitRevoked(result.revoked);
-            }
-            catch (error) {
-                // Unverified revocation evidence is only an unavailable read: a forged refusal must neither reset nor block.
-                if (error instanceof AccountBridgeRevoked)
-                    await this.confirmRevocationEvidence(error.evidence);
-                else if (!(error instanceof AccountReadUnavailable))
-                    this.policy.blockAccount(this.accountFailure(error).code);
-                if (!await this.policy.accountAvailable())
-                    this.emitRevoked(await this.policy.accountEndpointIds());
-                throw error;
-            }
-        };
-        this.accountRefresh = run().finally(() => { this.accountRefresh = null; });
-        return this.accountRefresh;
-    }
-    async adoptAccount(actor, head) {
-        await this.policy.revalidate(actor, 'admin');
-        if (actor.endpoint.kind !== 'browser' || !this.options.readAccountHistory)
-            throw new BridgeSecurityError('account_approval_required');
-        if (this.bridgeRevokedEmitted)
-            throw new BridgeSecurityError('account_bridge_revoked');
+    onRevoked(listener) { this.revoked.add(listener); return () => this.revoked.delete(listener); }
+    /**
+     * Account mode only: fires when a request (hello or application) is refused with approval_required for an endpoint the trusted
+     * ledger does not know, e.g. a browser whose add_device this replica has not seen yet (the wiring refreshes the ledger). Never for
+     * a revoked endpoint, never in Solo/local, never for the provisioned local CLI. At most once per endpoint per 2 s; listener errors
+     * are logged; the refusal itself is unchanged.
+     */
+    onApprovalRequired(listener) {
+        this.approvalListeners.add(listener);
+        return () => { this.approvalListeners.delete(listener); };
+    }
+    async senderPrincipal(endpointId) {
         try {
-            const parsedHead = z.object({ rootId: z.string().regex(/^[A-Za-z0-9_-]{43}$/), head: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
-                revision: z.number().int().min(0).max(ACCOUNT_TRUST_LIMITS.maxTransitions) }).strict().parse(head);
-            const history = await this.options.readAccountHistory(this.accountAbort.signal);
-            if (!history)
-                throw new BridgeSecurityError('account_approval_required');
-            if (this.closed)
-                throw new BridgeSecurityError('account_storage_unavailable');
-            const result = await this.adoptFetched(history, () => this.policy.applyAccountRead(history, { actor, head: parsedHead }));
-            this.emitRevoked(result.revoked);
-            return result.head;
+            return await this.policy.principal(endpointId);
         }
         catch (error) {
-            if (error instanceof AccountReadUnavailable)
-                throw new BridgeSecurityError('account_storage_unavailable');
-            if (error instanceof AccountBridgeRevoked) {
-                throw new BridgeSecurityError(await this.confirmRevocationEvidence(error.evidence) ? 'account_bridge_revoked' : 'account_storage_unavailable');
+            if (error instanceof BridgeSecurityError && error.code === 'approval_required')
+                this.noteApprovalRequired(endpointId);
+            throw error;
+        }
+    }
+    noteApprovalRequired(endpointId) {
+        if (!this.options.ledger || this.closed || this.approvalListeners.size === 0)
+            return;
+        const trusted = this.trustedView;
+        if (trusted !== null && (trusted.revokedDeviceIds.includes(endpointId) || trusted.devices.some(item => item.endpoint.id === endpointId)))
+            return;
+        const at = this.ledgerMonotonic();
+        for (const [id, emittedAt] of this.approvalEmitted) {
+            if (!(at - emittedAt < APPROVAL_SPACING_MS && at >= emittedAt))
+                this.approvalEmitted.delete(id);
+        }
+        if (this.approvalEmitted.has(endpointId) || this.approvalEmitted.size >= APPROVAL_TRACKED_LIMIT)
+            return;
+        this.approvalEmitted.set(endpointId, at);
+        const failed = (error) => console.error('[Security] approvalRequired listener failed:', error);
+        for (const listener of Array.from(this.approvalListeners)) {
+            try {
+                const result = listener(endpointId);
+                if (result instanceof Promise)
+                    result.catch(failed);
+            }
+            catch (error) {
+                failed(error);
             }
-            throw this.accountFailure(error);
         }
     }
-    onRevoked(listener) { this.revoked.add(listener); return () => this.revoked.delete(listener); }
     /** Fires at most once per instance, only on signed proof that this bridge was revoked. */
     onBridgeRevoked(listener) {
         this.bridgeRevokedListeners.add(listener);
@@ -441,16 +716,13 @@ export class BridgeSecurityService {
     }
     async close() {
         this.closed = true;
-        this.accountAbort.abort();
-        this.accountTrigger?.dispose();
-        this.accountTrigger = null;
-        if (this.accountTimer)
-            clearTimeout(this.accountTimer);
-        this.accountTimer = null;
-        await this.accountRefresh?.catch(() => undefined);
+        await this.ledgerTail.catch(() => undefined);
         this.revoked.clear();
         this.bridgeRevokedListeners.clear();
+        this.approvalListeners.clear();
+        this.approvalEmitted.clear();
         this.replay.clear();
+        this.headListeners.clear();
         await this.policy.close();
     }
 }