@byokit/pair 0.10.3 → 0.10.4

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+## 0.10.4 (2026-10-18)
+
+- FIX: A code that ran out while the person was saying yes now tells the computer too. When the yes landed after the offer's own expiry but inside the answer time, the device was refused `expired` while `confirm`'s `signal` never aborted, so the computer said nothing; it now aborts once, the same way a run-out during the question does, and still no grant is written.
+
 ## 0.10.3 (2026-10-17)
 
 - FIX: A pairing code that runs out while the computer's person has not answered now tells the device "That pairing code has run out" instead of "Your computer said no to this device". `confirm` gets a second argument, `{ signal }`, that aborts when the code runs out so the computer's prompt can close; a yes that comes later grants nothing.

package/README.md

@@ -500,7 +500,8 @@ the real host, so **both screens still show the same two words and host approval
 Only an explicit affirmative response after matching words should return `true` from `confirm`.
 The kit has no approval UI; exceptions decline. A confirmation still pending when the code runs out is refused as
 `expired` (the device says the code ran out), and `confirm`'s `signal` aborts then so the prompt can close; a yes
-that arrives later grants nothing.
+that arrives later grants nothing. A yes that lands after the code ran out but before that answer time is up is refused
+the same way: the device hears `expired` and the `signal` aborts, so the computer can say so too.
 
 For relay discovery, display the separate six-character `RelayClient.code()` lookup alongside
 the full `host.shortCode()` pairing code. The device calls `findHost(relay, lookup)` from

package/dist/host.d.ts

@@ -65,7 +65,8 @@ export type HostOptions = {
     /** Answers a device's request. Runs on the host, with the host's credentials; the device only gets the answer. */
     handle: (req: LinkRequest, device: Grant) => unknown;
     /** Asks the person at the host whether this device may join; nothing is stored until it says yes. `signal` aborts
-     *  when the pairing code runs out, so the app can close its prompt; a yes that comes later grants nothing. */
+     *  when the pairing code runs out, so the app can close its prompt, and also when a yes lands after it ran out;
+     *  a yes that comes later grants nothing. */
     confirm: (p: PairRequest, o: {
         signal: AbortSignal;
     }) => boolean | Promise<boolean>;

package/dist/host.js

@@ -465,6 +465,8 @@ export class Host {
                     refuse('full');
             }
             catch (e) {
+                if (e instanceof PairExpired)
+                    ask.abort(); // the offer ran out during the yes: tell the computer too
                 if (!gone)
                     refuse(e instanceof PairExpired ? 'expired' : 'failed');
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/pair",
-  "version": "0.10.3",
+  "version": "0.10.4",
   "description": "Scan a code to pair a phone or browser with the home computer over one encrypted link (Noise IK over WebSocket).",
   "license": "Apache-2.0",
   "type": "module",