@agentproto/pair-client 0.2.0

package/dist/index.mjs

@@ -0,0 +1,776 @@
+import { MAX_FRAME_PAYLOAD_BYTES, encodeData, clientHandshakeOverSink, decodeData, wrapWebSocket, splitPayload } from '@agentproto/acp/tunnel/browser';
+import { PAIR_VERSION, deriveOfferTokens, derivePairRoot, importPairRootKey, parseOfferUrl, PairingError, startClientHandshake, encodePairingMessage, decodePairingReply, currentEpoch, deriveEpochTokens } from '@agentproto/secrets/pairing/browser';
+export { DEFAULT_PAIR_PAGE, PAIR_PAGE_FP_PLACEHOLDER, PAIR_WEB_URL, PAIR_WEB_URL_TEMPLATE_CLOUD, encodeOfferWebUrl, expectedPairHost, resolvePairPageUrl } from '@agentproto/secrets/pairing/browser';
+
+/**
+ * @agentproto/pair-client
+ * Browser-safe client for agentproto E2E daemon pairing — pair from an offer,
+ * then fetch through the daemon over an end-to-end encrypted rendezvous tunnel.
+ */
+
+
+// src/errors.ts
+var TunnelClientError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "TunnelClientError";
+    this.code = code;
+  }
+};
+function revokedError(daemonName) {
+  return new TunnelClientError(
+    "revoked",
+    `this device was unpaired from ${daemonName}; scan a new pairing QR`
+  );
+}
+function outdatedError(what, options) {
+  return new TunnelClientError(
+    "protocol_outdated",
+    `${what} uses the retired pair/v1 protocol; upgrade agentproto on the daemon and scan a new pairing QR (\`agentproto pair offer --qr\`)`,
+    options
+  );
+}
+function errMsg(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/channel.ts
+var PAIRING_REVOKED_CODE = "pairing_revoked";
+var PAIRING_PROTOCOL_OUTDATED_CODE = "pairing_protocol_outdated";
+var DEFAULT_DIAL_TIMEOUT_MS = 15e3;
+var DEFAULT_HANDSHAKE_TIMEOUT_MS = 15e3;
+var DEFAULT_GREETING_TIMEOUT_MS = 1e4;
+function rendezvousClientUrl(base, token) {
+  const sep = base.includes("?") ? "&" : "?";
+  return `${base}${sep}side=client&t=${encodeURIComponent(token)}`;
+}
+function dialRendezvous(rendezvousUrl, token, WebSocketImpl, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let ws;
+    try {
+      ws = new WebSocketImpl(rendezvousClientUrl(rendezvousUrl, token));
+    } catch (err) {
+      reject(err);
+      return;
+    }
+    let settled = false;
+    const finish = (fn) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      ws.removeEventListener("open", onOpen);
+      ws.removeEventListener("error", onFail);
+      ws.removeEventListener("close", onFail);
+      fn();
+    };
+    const onOpen = () => finish(() => {
+      if (ws.readyState !== 1) reject(new Error("rendezvous closed the connection on arrival"));
+      else resolve(wrapWebSocket(ws));
+    });
+    const onFail = () => finish(() => reject(new Error("rendezvous dial failed")));
+    const timer = setTimeout(
+      () => finish(() => {
+        try {
+          ws.close();
+        } catch {
+        }
+        reject(new Error(`rendezvous dial timed out after ${timeoutMs}ms`));
+      }),
+      timeoutMs
+    );
+    ws.addEventListener("open", onOpen);
+    ws.addEventListener("error", onFail);
+    ws.addEventListener("close", onFail);
+  });
+}
+async function openChannel(params) {
+  const raw = await dialRendezvous(
+    params.rendezvousUrl,
+    params.route,
+    params.WebSocket,
+    params.dialTimeoutMs ?? DEFAULT_DIAL_TIMEOUT_MS
+  );
+  let sink;
+  let session = null;
+  try {
+    const started = await startClientHandshake({
+      daemonX25519Pub: params.daemonX25519Pub,
+      daemonEd25519Pub: params.daemonEd25519Pub,
+      authToken: params.auth,
+      clientName: params.clientName
+    });
+    sink = await clientHandshakeOverSink(
+      raw,
+      encodePairingMessage(started.hello),
+      async (reply) => {
+        session = await started.complete(decodePairingReply(reply));
+        return session;
+      },
+      { timeoutMs: params.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS }
+    );
+  } catch (err) {
+    raw.close("handshake failed");
+    throw err;
+  }
+  if (!session) {
+    sink.close("handshake failed");
+    throw new Error("handshake did not derive a session");
+  }
+  let router = null;
+  const backlog = [];
+  let onGreeting = null;
+  sink.onFrame((frame) => {
+    if (onGreeting) {
+      const cb = onGreeting;
+      onGreeting = null;
+      cb(frame);
+      return;
+    }
+    if (router) router(frame);
+    else backlog.push(frame);
+  });
+  const timeoutMs = params.greetingTimeoutMs ?? DEFAULT_GREETING_TIMEOUT_MS;
+  let greeting;
+  try {
+    greeting = await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error("no greeting from the daemon")), timeoutMs);
+      const offClose = sink.onClose((reason) => {
+        clearTimeout(timer);
+        reject(new Error(`channel closed before the daemon greeted: ${reason ?? "closed"}`));
+      });
+      onGreeting = (frame) => {
+        clearTimeout(timer);
+        offClose();
+        if (frame.t === "hello") resolve({ kind: "hello", hello: frame });
+        else if (frame.t === "error" && frame.code === PAIRING_REVOKED_CODE)
+          resolve({ kind: "revoked", frame });
+        else if (frame.t === "error" && frame.code === PAIRING_PROTOCOL_OUTDATED_CODE)
+          resolve({ kind: "outdated", frame });
+        else reject(new Error(`unexpected first frame from the daemon: "${frame.t}"`));
+      };
+    });
+  } catch (err) {
+    sink.close("no greeting");
+    throw err;
+  }
+  return {
+    sink,
+    session,
+    greeting,
+    route(handler) {
+      router = handler;
+      for (const f of backlog.splice(0)) handler(f);
+    }
+  };
+}
+function daemonNameFromHello(hello, fallback) {
+  if (hello?.label) return hello.label;
+  const platform = hello?.daemon?.platform;
+  const host = platform?.includes("/") ? platform.slice(platform.indexOf("/") + 1) : void 0;
+  return host || fallback;
+}
+function defaultWebSocket() {
+  const ctor = globalThis.WebSocket;
+  if (!ctor) {
+    throw new TunnelClientError("offline", "no WebSocket implementation in this context (pass opts.WebSocket)");
+  }
+  return ctor;
+}
+
+// src/client.ts
+var NULL_BODY_STATUS = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+var DROP_RESPONSE_HEADERS = /* @__PURE__ */ new Set(["connection", "transfer-encoding", "content-encoding", "content-length", "keep-alive"]);
+var BASE = "http://tunnel.invalid";
+function connect(credential, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const random = opts.random ?? Math.random;
+  const WebSocketImpl = opts.WebSocket ?? defaultWebSocket();
+  const minMs = opts.reconnectMinMs ?? 500;
+  const maxMs = opts.reconnectMaxMs ?? 3e4;
+  const requestWaitMs = opts.requestWaitMs ?? 2e4;
+  const keepAliveMs = opts.keepAliveMs ?? 25e3;
+  const pongTimeoutMs = opts.pongTimeoutMs ?? 1e4;
+  const mapPath = opts.mapPath ?? ((url) => `${url.pathname}${url.search}`);
+  const reqPrefix = Math.floor(random() * 4294967296).toString(36);
+  let state = "connecting";
+  let lastError = null;
+  let hello = null;
+  let live = null;
+  let stopped = false;
+  let seq = 0;
+  const listeners = /* @__PURE__ */ new Set();
+  let wake = null;
+  const notify = (change) => {
+    for (const l of [...listeners]) {
+      try {
+        l(change);
+      } catch {
+      }
+    }
+  };
+  const setState = (next, error) => {
+    if (error) lastError = error;
+    if (next === state && !error) return;
+    state = next;
+    notify(error ? { state, error } : { state });
+  };
+  const failPending = (l, err) => {
+    for (const [, p] of l.pending) {
+      p.detach();
+      if (!p.settled) {
+        p.settled = true;
+        p.reject(err);
+      } else if (p.controller) {
+        try {
+          p.controller.error(err);
+        } catch {
+        }
+      }
+    }
+    l.pending.clear();
+  };
+  const sleep = (ms) => new Promise((resolve) => {
+    const timer = setTimeout(done, ms);
+    function done() {
+      clearTimeout(timer);
+      wake = null;
+      resolve();
+    }
+    wake = done;
+  });
+  async function establish() {
+    const epoch = currentEpoch(now());
+    let lastErr;
+    for (const e of [epoch, epoch - 1]) {
+      if (stopped) break;
+      try {
+        const { route, auth } = await deriveEpochTokens(credential.pairRoot, e);
+        const ch = await openChannel({
+          rendezvousUrl: credential.rendezvousUrl,
+          route,
+          auth,
+          daemonX25519Pub: credential.daemonX25519Pub,
+          daemonEd25519Pub: credential.daemonEd25519Pub,
+          clientName: credential.clientName,
+          WebSocket: WebSocketImpl,
+          ...opts.dialTimeoutMs !== void 0 ? { dialTimeoutMs: opts.dialTimeoutMs } : {},
+          ...opts.handshakeTimeoutMs !== void 0 ? { handshakeTimeoutMs: opts.handshakeTimeoutMs } : {},
+          ...opts.greetingTimeoutMs !== void 0 ? { greetingTimeoutMs: opts.greetingTimeoutMs } : {}
+        });
+        if (ch.greeting.kind === "revoked") {
+          ch.sink.close("revoked");
+          throw revokedError(credential.name);
+        }
+        if (ch.greeting.kind === "outdated") {
+          ch.sink.close("outdated");
+          throw outdatedError(`this device's pairing with ${credential.name}`);
+        }
+        return { sink: ch.sink, hello: ch.greeting.hello, route: ch.route };
+      } catch (err) {
+        if (err instanceof TunnelClientError && (err.code === "revoked" || err.code === "protocol_outdated")) throw err;
+        lastErr = err;
+      }
+    }
+    throw new TunnelClientError(
+      "offline",
+      `could not reach ${credential.name} via ${credential.rendezvousUrl}: ${errMsg(lastErr)}`,
+      { cause: lastErr }
+    );
+  }
+  function serve(ch) {
+    const l = { sink: ch.sink, pending: /* @__PURE__ */ new Map() };
+    live = l;
+    hello = ch.hello;
+    let revoked = null;
+    let pingTimer = null;
+    let pongTimer = null;
+    let pingSeq = 0;
+    return new Promise((resolve) => {
+      ch.route((frame) => {
+        switch (frame.t) {
+          case "http_response":
+          case "http_response_head":
+          case "http_response_chunk":
+            onHttpFrame(l, frame);
+            return;
+          case "pong":
+            if (pongTimer) clearTimeout(pongTimer);
+            pongTimer = null;
+            return;
+          case "ping":
+            l.sink.send({ t: "pong", nonce: frame.nonce });
+            return;
+          case "error":
+            if (frame.code === PAIRING_REVOKED_CODE) {
+              revoked = revokedError(credential.name);
+              l.sink.close("revoked");
+            }
+            return;
+          default:
+            return;
+        }
+      });
+      if (keepAliveMs > 0) {
+        pingTimer = setInterval(() => {
+          if (pongTimer) return;
+          l.sink.send({ t: "ping", nonce: `ka-${++pingSeq}` });
+          pongTimer = setTimeout(() => l.sink.close("keepalive timeout"), pongTimeoutMs);
+        }, keepAliveMs);
+      }
+      l.sink.onClose(() => {
+        if (pingTimer) clearInterval(pingTimer);
+        if (pongTimer) clearTimeout(pongTimer);
+        if (live === l) live = null;
+        failPending(
+          l,
+          revoked ?? (stopped ? new TunnelClientError("closed", "the tunnel client was closed") : new TunnelClientError("disconnected", `lost the connection to ${credential.name}`))
+        );
+        resolve(revoked);
+      });
+      if (!l.sink.isOpen) {
+        failPending(l, new TunnelClientError("disconnected", `lost the connection to ${credential.name}`));
+        resolve(revoked);
+      }
+    });
+  }
+  async function run() {
+    let attempt = 0;
+    while (!stopped) {
+      setState("connecting");
+      let ch;
+      try {
+        ch = await establish();
+      } catch (err) {
+        if (stopped) return;
+        const e = err instanceof TunnelClientError ? err : new TunnelClientError("offline", errMsg(err), { cause: err });
+        if (e.code === "revoked") {
+          setState("revoked", e);
+          return;
+        }
+        if (e.code === "protocol_outdated") {
+          setState("outdated", e);
+          return;
+        }
+        setState("offline", e);
+        await sleep(backoff(attempt++));
+        continue;
+      }
+      if (stopped) {
+        ch.sink.close("client closed");
+        return;
+      }
+      attempt = 0;
+      const closed = serve(ch);
+      setState("open");
+      if (opts.store) {
+        void opts.store.put({ ...credential, lastSeen: new Date(now()).toISOString() }).catch(() => {
+        });
+      }
+      const revoked = await closed;
+      if (stopped) return;
+      if (revoked) {
+        setState("revoked", revoked);
+        return;
+      }
+      setState("offline", new TunnelClientError("disconnected", `lost the connection to ${credential.name}`));
+      await sleep(backoff(attempt++));
+    }
+  }
+  function backoff(n) {
+    const cap = Math.min(maxMs, minMs * 2 ** Math.min(n, 30));
+    return cap / 2 + random() * (cap / 2);
+  }
+  function onHttpFrame(l, frame) {
+    const p = l.pending.get(frame.reqId);
+    if (!p) return;
+    if (frame.t === "http_response") {
+      l.pending.delete(frame.reqId);
+      p.detach();
+      if (p.settled) return;
+      p.settled = true;
+      let body = frame.body ? decodeData(frame.body) : null;
+      if (!body?.length && frame.error) {
+        body = new TextEncoder().encode(JSON.stringify({ error: frame.error.code, message: frame.error.message }));
+      }
+      p.resolve(makeResponse(frame.status, frame.headers, body));
+      return;
+    }
+    if (frame.t === "http_response_head") {
+      if (p.settled) return;
+      p.settled = true;
+      const stream = new ReadableStream({
+        start: (c2) => {
+          p.controller = c2;
+        },
+        cancel: () => {
+          if (l.pending.get(frame.reqId) === p) {
+            l.pending.delete(frame.reqId);
+            p.detach();
+            l.sink.send({ t: "http_cancel", reqId: frame.reqId });
+          }
+        }
+      });
+      p.resolve(makeResponse(frame.status, frame.headers, stream));
+      return;
+    }
+    const c = p.controller;
+    if (!c) return;
+    try {
+      if (frame.data) c.enqueue(decodeData(frame.data));
+      if (frame.error) {
+        l.pending.delete(frame.reqId);
+        p.detach();
+        c.error(new TunnelClientError("stream_error", `${frame.error.code}: ${frame.error.message}`));
+      } else if (frame.end) {
+        l.pending.delete(frame.reqId);
+        p.detach();
+        c.close();
+      }
+    } catch {
+    }
+  }
+  function waitForLive(signal) {
+    if (state === "open" && live) return Promise.resolve(live);
+    if (state === "revoked") return Promise.reject(lastError ?? revokedError(credential.name));
+    if (state === "outdated") return Promise.reject(lastError ?? outdatedError(`this device's pairing with ${credential.name}`));
+    if (state === "closed") return Promise.reject(new TunnelClientError("closed", "the tunnel client was closed"));
+    return new Promise((resolve, reject) => {
+      const done = (fn) => {
+        clearTimeout(timer);
+        off();
+        signal.removeEventListener("abort", onAbort);
+        fn();
+      };
+      const timer = setTimeout(
+        () => done(
+          () => reject(
+            new TunnelClientError(
+              "offline",
+              `${credential.name} is unreachable (no connection within ${requestWaitMs}ms)` + (lastError ? `: ${lastError.message}` : ""),
+              lastError ? { cause: lastError } : void 0
+            )
+          )
+        ),
+        requestWaitMs
+      );
+      const onAbort = () => done(() => reject(signal.reason));
+      signal.addEventListener("abort", onAbort);
+      const off = onStateChangeImpl(({ state: s, error }) => {
+        if (s === "open" && live) {
+          const l = live;
+          done(() => resolve(l));
+        } else if (s === "revoked" || s === "outdated" || s === "closed") {
+          done(
+            () => reject(
+              error ?? new TunnelClientError(s === "outdated" ? "protocol_outdated" : s, `the tunnel client is ${s}`)
+            )
+          );
+        }
+      });
+    });
+  }
+  async function tunnelFetch(input, init) {
+    const request = input instanceof Request ? init ? new Request(input, init) : input : new Request(new URL(String(input), BASE), init);
+    const signal = request.signal;
+    if (signal.aborted) throw signal.reason;
+    const method = request.method.toUpperCase();
+    const body = method === "GET" || method === "HEAD" ? null : new Uint8Array(await request.arrayBuffer());
+    const headers = {};
+    request.headers.forEach((value, key) => {
+      headers[key] = value;
+    });
+    const path = mapPath(new URL(request.url));
+    if (!path.startsWith("/")) throw new TypeError(`tunnel path must start with "/" (got "${path}")`);
+    const l = await waitForLive(signal);
+    if (signal.aborted) throw signal.reason;
+    if (!l.sink.isOpen) {
+      throw new TunnelClientError("disconnected", `lost the connection to ${credential.name}`);
+    }
+    const reqId = `${reqPrefix}-${(++seq).toString(36)}`;
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        const p = l.pending.get(reqId);
+        if (!p) return;
+        l.pending.delete(reqId);
+        p.detach();
+        l.sink.send({ t: "http_cancel", reqId });
+        if (!p.settled) {
+          p.settled = true;
+          reject(signal.reason);
+        } else {
+          try {
+            p.controller?.error(signal.reason);
+          } catch {
+          }
+        }
+      };
+      const pending = {
+        resolve,
+        reject,
+        controller: null,
+        settled: false,
+        detach: () => signal.removeEventListener("abort", onAbort)
+      };
+      l.pending.set(reqId, pending);
+      signal.addEventListener("abort", onAbort);
+      const base = {
+        t: "http_request",
+        reqId,
+        method,
+        path,
+        ...Object.keys(headers).length ? { headers } : {}
+      };
+      if (body && body.length > MAX_FRAME_PAYLOAD_BYTES && hello?.capabilities.httpRequestChunks === true) {
+        l.sink.send({ ...base, bodyChunked: true });
+        const pieces = splitPayload(body);
+        pieces.forEach((piece, i) => {
+          l.sink.send({
+            t: "http_request_chunk",
+            reqId,
+            data: encodeData(piece),
+            ...i === pieces.length - 1 ? { end: true } : {}
+          });
+        });
+      } else {
+        l.sink.send({ ...base, ...body && body.length ? { body: encodeData(body) } : {} });
+      }
+    });
+  }
+  function onStateChangeImpl(listener) {
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+  }
+  if (credential.protocol !== PAIR_VERSION) {
+    setState("outdated", outdatedError(`this device's pairing with ${credential.name}`));
+    queueMicrotask(() => {
+      if (state === "outdated" && lastError) notify({ state, error: lastError });
+    });
+  } else void run().catch((err) => {
+    setState("offline", new TunnelClientError("offline", errMsg(err), { cause: err }));
+  });
+  return {
+    credential,
+    get state() {
+      return state;
+    },
+    get hello() {
+      return hello;
+    },
+    get lastError() {
+      return lastError;
+    },
+    onStateChange: onStateChangeImpl,
+    ready() {
+      return waitForLive(new AbortController().signal).then(() => void 0);
+    },
+    fetch: tunnelFetch,
+    reconnect() {
+      wake?.();
+    },
+    close() {
+      if (stopped) return;
+      stopped = true;
+      wake?.();
+      const l = live;
+      live = null;
+      if (l) {
+        failPending(l, new TunnelClientError("closed", "the tunnel client was closed"));
+        l.sink.close("client closed");
+      }
+      if (state !== "revoked" && state !== "outdated") setState("closed");
+    }
+  };
+}
+function makeResponse(status, headers, body) {
+  const h = new Headers();
+  for (const [k, v] of Object.entries(headers ?? {})) {
+    if (DROP_RESPONSE_HEADERS.has(k.toLowerCase())) continue;
+    try {
+      h.append(k, v);
+    } catch {
+    }
+  }
+  const s = Number.isInteger(status) && status >= 200 && status <= 599 ? status : 502;
+  if (NULL_BODY_STATUS.has(s)) {
+    if (body instanceof ReadableStream) void body.cancel().catch(() => {
+    });
+    return new Response(null, { status: s, headers: h });
+  }
+  return new Response(body, { status: s, headers: h });
+}
+async function parse(offerUrl, now) {
+  try {
+    return await parseOfferUrl(offerUrl, { now });
+  } catch (err) {
+    if (err instanceof PairingError && err.code === "pairing_protocol_outdated") {
+      throw outdatedError("this pairing QR", { cause: err });
+    }
+    const expired = err instanceof PairingError && err.code === "offer_expired";
+    throw new TunnelClientError(
+      "invalid_offer",
+      expired ? "this pairing offer has expired; run `agentproto pair offer --qr` again" : errMsg(err),
+      { cause: err }
+    );
+  }
+}
+async function inspectOffer(offerUrl, opts = {}) {
+  const offer = await parse(offerUrl, opts.now ?? Date.now());
+  return {
+    fingerprint: offer.fingerprint,
+    rendezvousUrl: offer.rendezvousUrl,
+    expiresAt: new Date(offer.exp * 1e3)
+  };
+}
+function defaultClientName() {
+  const host = globalThis.location?.host;
+  return host ? `browser@${host}` : "browser";
+}
+async function pairFromOffer(offerUrl, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const offer = await parse(offerUrl, now());
+  const clientName = opts.clientName ?? defaultClientName();
+  let channel;
+  try {
+    const { route, auth } = await deriveOfferTokens(offer.secret);
+    channel = await openChannel({
+      rendezvousUrl: offer.rendezvousUrl,
+      route,
+      auth,
+      daemonX25519Pub: offer.daemonX25519Pub,
+      daemonEd25519Pub: offer.daemonEd25519Pub,
+      clientName,
+      WebSocket: opts.WebSocket ?? defaultWebSocket(),
+      ...opts.dialTimeoutMs !== void 0 ? { dialTimeoutMs: opts.dialTimeoutMs } : {},
+      ...opts.handshakeTimeoutMs !== void 0 ? { handshakeTimeoutMs: opts.handshakeTimeoutMs } : {},
+      ...opts.greetingTimeoutMs !== void 0 ? { greetingTimeoutMs: opts.greetingTimeoutMs } : {}
+    });
+  } catch (err) {
+    throw new TunnelClientError("pairing_failed", `could not pair with daemon ${offer.fingerprint}: ${errMsg(err)}`, {
+      cause: err
+    });
+  }
+  const { sink, session, greeting } = channel;
+  if (session.peerFingerprint !== offer.fingerprint) {
+    sink.close("fingerprint mismatch");
+    throw new TunnelClientError(
+      "pairing_failed",
+      `daemon fingerprint ${session.peerFingerprint} does not match the offer's ${offer.fingerprint}`
+    );
+  }
+  if (greeting.kind === "outdated") {
+    sink.close("outdated");
+    throw outdatedError("this daemon");
+  }
+  let pairRoot = await derivePairRoot(session);
+  sink.close("pair complete");
+  const hello = greeting.kind === "hello" ? greeting.hello : null;
+  const daemon = {
+    fingerprint: offer.fingerprint,
+    name: daemonNameFromHello(hello, offer.fingerprint),
+    ...hello?.label ? { label: hello.label } : {},
+    ...hello?.daemon?.platform ? { platform: hello.daemon.platform } : {},
+    rendezvousUrl: offer.rendezvousUrl
+  };
+  return {
+    daemon,
+    async confirm() {
+      const root = pairRoot;
+      if (root === null) throw new TunnelClientError("cancelled", "this pairing was already confirmed or cancelled");
+      pairRoot = null;
+      const nowIso = new Date(now()).toISOString();
+      const credential = {
+        protocol: PAIR_VERSION,
+        id: offer.fingerprint,
+        fingerprint: offer.fingerprint,
+        name: daemon.name,
+        clientName,
+        daemonX25519Pub: offer.daemonX25519Pub,
+        daemonEd25519Pub: offer.daemonEd25519Pub,
+        rendezvousUrl: offer.rendezvousUrl,
+        pairRoot: await importPairRootKey(root),
+        createdAt: nowIso,
+        lastSeen: nowIso
+      };
+      await opts.store?.put(credential);
+      return credential;
+    },
+    cancel() {
+      pairRoot = null;
+    }
+  };
+}
+
+// src/credential.ts
+function createMemoryCredentialStore(initial = []) {
+  const byId = new Map(initial.map((c) => [c.id, c]));
+  return {
+    async get(id) {
+      return byId.get(id);
+    },
+    async put(credential) {
+      byId.set(credential.id, credential);
+    },
+    async delete(id) {
+      return byId.delete(id);
+    },
+    async list() {
+      return [...byId.values()];
+    }
+  };
+}
+function createIndexedDbCredentialStore(opts = {}) {
+  const dbName = opts.dbName ?? "agentproto-pair";
+  const storeName = opts.storeName ?? "credentials";
+  let dbPromise = null;
+  const open = () => {
+    if (dbPromise) return dbPromise;
+    const factory = opts.indexedDB ?? globalThis.indexedDB;
+    if (!factory) return Promise.reject(new Error("IndexedDB is not available in this context"));
+    dbPromise = new Promise((resolve, reject) => {
+      const req = factory.open(dbName, 1);
+      req.onupgradeneeded = () => {
+        if (!req.result.objectStoreNames.contains(storeName)) {
+          req.result.createObjectStore(storeName, { keyPath: "id" });
+        }
+      };
+      req.onsuccess = () => resolve(req.result);
+      req.onerror = () => reject(req.error ?? new Error("IndexedDB open failed"));
+    });
+    dbPromise.catch(() => {
+      dbPromise = null;
+    });
+    return dbPromise;
+  };
+  const run = async (mode, op) => {
+    const db = await open();
+    return new Promise((resolve, reject) => {
+      const tx = db.transaction(storeName, mode);
+      const req = op(tx.objectStore(storeName));
+      tx.oncomplete = () => resolve(req.result);
+      tx.onerror = () => reject(tx.error ?? req.error ?? new Error("IndexedDB request failed"));
+      tx.onabort = () => reject(tx.error ?? new Error("IndexedDB transaction aborted"));
+    });
+  };
+  return {
+    async get(id) {
+      return await run("readonly", (s) => s.get(id)) ?? void 0;
+    },
+    async put(credential) {
+      await run("readwrite", (s) => s.put(credential));
+    },
+    async delete(id) {
+      const existing = await run("readonly", (s) => s.count(id));
+      if (existing === 0) return false;
+      await run("readwrite", (s) => s.delete(id));
+      return true;
+    },
+    async list() {
+      return run("readonly", (s) => s.getAll());
+    }
+  };
+}
+
+export { PAIRING_REVOKED_CODE, TunnelClientError, connect, createIndexedDbCredentialStore, createMemoryCredentialStore, inspectOffer, pairFromOffer };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map