@byokit/pair 0.10.2 → 0.10.3

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+## 0.10.3 (2026-10-17)
+
+- FIX: A pairing code that runs out while the computer's person has not answered now tells the device "That pairing code has run out" instead of "Your computer said no to this device". `confirm` gets a second argument, `{ signal }`, that aborts when the code runs out so the computer's prompt can close; a yes that comes later grants nothing.
+
 ## 0.10.2 (2026-10-17)
 
 - FIX: a busy host that answers a ping late no longer has its live link dropped. `DeviceLink` now counts any pong up to the latest ping, a reply to one of its own waiting requests, or a frame on one of its own streams as hearing from the host, and counts silence from its first ping rather than from the connect, so a host that answers even that first ping late stays online. A host that goes silent is still dropped after two silent ping rounds (`2 × pingMs`, checked once a round). Host events and broadcasts alone still do not keep a link up: they show only that the host can talk, not that it hears the device, so only an answer to something the device sent proves the round trip.

package/README.md

@@ -498,7 +498,9 @@ late approval and expiry never create a grant. Malicious routing can still deny
 a code by forwarding a live attempt. Anyone who photographs the full code can race to pair with
 the real host, so **both screens still show the same two words and host approval defaults to No**.
 Only an explicit affirmative response after matching words should return `true` from `confirm`.
-The kit has no approval UI; exceptions and confirmation timeouts decline.
+The kit has no approval UI; exceptions decline. A confirmation still pending when the code runs out is refused as
+`expired` (the device says the code ran out), and `confirm`'s `signal` aborts then so the prompt can close; a yes
+that arrives later grants nothing.
 
 For relay discovery, display the separate six-character `RelayClient.code()` lookup alongside
 the full `host.shortCode()` pairing code. The device calls `findHost(relay, lookup)` from

package/dist/host.d.ts

@@ -64,8 +64,11 @@ export type HostOptions = {
     name: string;
     /** Answers a device's request. Runs on the host, with the host's credentials; the device only gets the answer. */
     handle: (req: LinkRequest, device: Grant) => unknown;
-    /** Asks the person at the host whether this device may join; nothing is stored until it says yes. */
-    confirm: (p: PairRequest) => boolean | Promise<boolean>;
+    /** Asks the person at the host whether this device may join; nothing is stored until it says yes. `signal` aborts
+     *  when the pairing code runs out, so the app can close its prompt; a yes that comes later grants nothing. */
+    confirm: (p: PairRequest, o: {
+        signal: AbortSignal;
+    }) => boolean | Promise<boolean>;
     /** Takes a stream a device opened with `link.stream(op, args)` (a terminal pane, a tunnelled connection, a call):
      *  set `onData` and `onEnd`, `write`, `end`. The stream opens before this handler runs; a thrown
      *  `PublicLinkError` ends it with a message for the device, while other errors go to `onError` and end it with

package/dist/host.js

@@ -434,14 +434,22 @@ export class Host {
             clearTimeout(timer);
             const req = { name: cleanName(name, 'Device'), role: p.role, words: hs.words, how,
                 ...(p.kind === undefined ? {} : { kind: p.kind }), ...(p.lifetime ? { lifetime: p.lifetime } : {}), ...(p.meta === undefined ? {} : { meta: p.meta }) };
+            const ask = new AbortController();
+            let runOut;
             const yes = await Promise.race([
-                Promise.resolve().then(() => this.opts.confirm(req)).catch(() => false),
-                new Promise((r) => later(this.pairMs, () => r(false))),
+                Promise.resolve().then(() => this.opts.confirm(req, { signal: ask.signal })).catch(() => false),
+                new Promise((r) => { runOut = later(this.pairMs, () => { ask.abort(); r('expired'); }); }),
             ]);
+            clearTimeout(runOut);
             // A device that said it kept a pending grant resumes from it after being killed while the person decided, so
             // its yes outlives the socket; any other gone device could never use the grant, so it gets none.
             if (gone && kept !== 1)
                 return;
+            if (yes === 'expired') {
+                if (!gone)
+                    refuse('expired');
+                return;
+            } // a yes that comes later is ignored: no grant
             if (!yes) {
                 if (!gone)
                     refuse('declined');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/pair",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "description": "Scan a code to pair a phone or browser with the home computer over one encrypted link (Noise IK over WebSocket).",
   "license": "Apache-2.0",
   "type": "module",