@peers-app/peers-sdk 0.23.14 → 0.25.0

package/dist/device-pairing/crypto.js

@@ -1,12 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.derivePairingRoomAccessToken = derivePairingRoomAccessToken;
-exports.hashPairingRoomAccessToken = hashPairingRoomAccessToken;
-exports.derivePairingSignalingKey = derivePairingSignalingKey;
+exports.startPairingPake = startPairingPake;
+exports.derivePairingSessionKeys = derivePairingSessionKeys;
+exports.derivePairingWebSocketToken = derivePairingWebSocketToken;
 exports.computePairingSignalMac = computePairingSignalMac;
 exports.isPairingSignalMacValid = isPairingSignalMacValid;
-exports.createSignedPairingApproval = createSignedPairingApproval;
-exports.verifySignedPairingApproval = verifySignedPairingApproval;
+exports.createPairingConfirmation = createPairingConfirmation;
+exports.verifyPairingConfirmation = verifyPairingConfirmation;
 exports.createPairingCredentialEnvelope = createPairingCredentialEnvelope;
 exports.openPairingCredentialEnvelope = openPairingCredentialEnvelope;
 exports.createSignedPairingInstallationReceipt = createSignedPairingInstallationReceipt;
@@ -15,6 +15,8 @@ const hmac_1 = require("@noble/hashes/hmac");
 const sha2_1 = require("@noble/hashes/sha2");
 const keys_1 = require("../keys");
 const constants_1 = require("./constants");
+const cpace_1 = require("./cpace");
+const pairing_code_1 = require("./pairing-code");
 const types_1 = require("./types");
 const textEncoder = new TextEncoder();
 function computeHmac(key, value) {
@@ -30,17 +32,42 @@ function equalBytes(left, right) {
     }
     return difference === 0;
 }
-/** Derives the high-entropy bearer credential presented when joining a room. */
-function derivePairingRoomAccessToken(roomSecret) {
-    return (0, keys_1.encodeBase64)(computeHmac((0, keys_1.decodeBase64)(roomSecret), constants_1.DEVICE_PAIRING_ROOM_ACCESS_LABEL));
+/**
+ * Starts CPace for one role. The source is the initiator and the destination the responder;
+ * the exchange is bound to the service origin and nameplate so a relayed share from another
+ * room cannot be replayed.
+ */
+function startPairingPake(role, code, serviceOrigin) {
+    const session = (0, cpace_1.cpaceStart)(role === "source" ? "initiator" : "responder", {
+        password: (0, pairing_code_1.pairingPasswordFromCode)(code),
+        channelId: (0, pairing_code_1.pairingChannelId)(serviceOrigin, code.nameplate),
+        initiatorAd: textEncoder.encode("source"),
+        responderAd: textEncoder.encode("destination"),
+    });
+    return {
+        share: (0, keys_1.encodeBase64)(session.share),
+        finish(remoteShare) {
+            const isk = session.finish((0, keys_1.decodeBase64)(remoteShare));
+            const keys = derivePairingSessionKeys(isk);
+            isk.fill(0);
+            return keys;
+        },
+    };
 }
-/** Hashes a room bearer credential before the source gives its verifier to the service. */
-function hashPairingRoomAccessToken(roomAccessToken) {
-    return (0, keys_1.hashValue)(roomAccessToken);
+/** Derives independent signaling and confirmation keys from a PAKE intermediate session key. */
+function derivePairingSessionKeys(isk) {
+    return {
+        signalingKey: (0, keys_1.encodeBase64)(computeHmac(isk, constants_1.DEVICE_PAIRING_SIGNALING_LABEL)),
+        confirmKey: (0, keys_1.encodeBase64)(computeHmac(isk, constants_1.DEVICE_PAIRING_CONFIRM_LABEL)),
+    };
 }
-/** Derives the client-only key used to authenticate SDP and ICE messages. */
-function derivePairingSignalingKey(roomSecret) {
-    return (0, keys_1.encodeBase64)(computeHmac((0, keys_1.decodeBase64)(roomSecret), constants_1.DEVICE_PAIRING_SIGNALING_LABEL));
+/**
+ * Derives the token a source presents (`auth.token`) when it connects to the destination's direct
+ * WebSocket pairing listener. Both endpoints compute it from the signaling key, so it never
+ * travels through the rendezvous; a socket without it is refused before any Connection exists.
+ */
+function derivePairingWebSocketToken(signalingKey) {
+    return (0, keys_1.encodeBase64)(computeHmac((0, keys_1.decodeBase64)(signalingKey), constants_1.DEVICE_PAIRING_WEBSOCKET_TOKEN_LABEL));
 }
 /** Computes the MAC over the canonical unsigned signaling envelope. */
 function computePairingSignalMac(signal, signalingKey) {
@@ -56,31 +83,45 @@ function isPairingSignalMacValid(signal, mac, signalingKey) {
         return false;
     }
 }
-/** Creates a signed, expiring approval for one pairing transcript. */
-function createSignedPairingApproval(device, role, transcriptHash, expiresAt) {
-    const contents = types_1.pairingApprovalContentsSchema.parse({
+/** Builds the local `pairing.confirm` message authenticated with the PAKE confirmation key. */
+function createPairingConfirmation(contents, confirmKey) {
+    const parsed = types_1.pairingConfirmationContentsSchema.parse({
         version: constants_1.DEVICE_PAIRING_PROTOCOL_VERSION,
-        approvalId: (0, keys_1.newToken)(32),
-        transcriptHash,
-        role,
-        expiresAt,
+        ...contents,
+    });
+    return types_1.pairingConfirmationSchema.parse({
+        ...parsed,
+        mac: (0, keys_1.encodeBase64)(computeHmac((0, keys_1.decodeBase64)(confirmKey), (0, keys_1.stableStringify)(parsed))),
     });
-    return types_1.signedPairingApprovalSchema.parse(device.signObjectWithSecretKey(contents));
 }
-/** Verifies an approval's signature, endpoint identity, transcript, role, and lifetime. */
-function verifySignedPairingApproval(approval, expected) {
-    const parsed = types_1.signedPairingApprovalSchema.parse(approval);
-    if (parsed.publicKey !== expected.publicKey) {
-        throw new Error("Pairing approval came from an unexpected device");
+/**
+ * Verifies the remote confirmation's MAC, role, transcript, and identity binding.
+ * A MAC failure means the other endpoint used a different code or saw a different transcript.
+ */
+function verifyPairingConfirmation(value, confirmKey, expected) {
+    const parsed = types_1.pairingConfirmationSchema.parse(value);
+    const { mac, ...contents } = parsed;
+    const expectedMac = computeHmac((0, keys_1.decodeBase64)(confirmKey), (0, keys_1.stableStringify)(contents));
+    let macValid = false;
+    try {
+        macValid = equalBytes(expectedMac, (0, keys_1.decodeBase64)(mac));
     }
-    const contents = types_1.pairingApprovalContentsSchema.parse((0, keys_1.openSignedObject)(parsed));
-    if (contents.transcriptHash !== expected.transcriptHash || contents.role !== expected.role) {
-        throw new Error("Pairing approval does not match this ceremony");
+    catch {
+        macValid = false;
     }
-    if (contents.expiresAt < (expected.now ?? Date.now())) {
-        throw new Error("Pairing approval has expired");
+    if (!macValid) {
+        throw new Error("Pairing code did not match");
+    }
+    if (contents.role !== expected.role || contents.transcriptHash !== expected.transcriptHash) {
+        throw new Error("Pairing confirmation does not match this ceremony");
+    }
+    if (contents.device.userId !== expected.device.userId ||
+        contents.device.deviceId !== expected.device.deviceId ||
+        contents.device.publicKey !== expected.device.publicKey ||
+        contents.device.publicBoxKey !== expected.device.publicBoxKey) {
+        throw new Error("Pairing confirmation identity mismatch");
     }
-    return contents.approvalId;
+    return parsed;
 }
 /** Signs and encrypts account credentials directly to the temporary destination identity. */
 function createPairingCredentialEnvelope(sourceDevice, destinationDevice, credentials, transcriptHash, expiresAt) {

package/dist/device-pairing/device-pairing.test.js

@@ -5,137 +5,186 @@ const keys_1 = require("../keys");
 const utils_1 = require("../utils");
 const _1 = require(".");
 const NOW = 1_800_000_000_000;
+const ORIGIN = "https://peers.app";
 const FINGERPRINT = Array.from({ length: 32 }, (_, index) => index.toString(16).padStart(2, "0"))
     .join(":")
     .toUpperCase();
-describe("device pairing invitation", () => {
-    it("round-trips a versioned token and fragment URL", () => {
-        const invitation = (0, _1.createDevicePairingInvitation)({
-            serviceOrigin: "https://peers.app/path",
-            now: NOW,
-        });
-        const token = (0, _1.encodeDevicePairingInvitation)(invitation);
-        const url = (0, _1.createDevicePairingInvitationUrl)("https://app.peers.test/setup", invitation);
-        expect((0, _1.parseDevicePairingInvitation)(token, NOW)).toEqual(invitation);
-        expect((0, _1.parseDevicePairingInvitation)(url, NOW)).toEqual(invitation);
-        expect(invitation.roomId).toHaveLength(22);
-        expect(invitation.roomSecret).toHaveLength(43);
-        expect(invitation.serviceOrigin).toBe("https://peers.app");
+describe("pairing code", () => {
+    it("uses the full PGP word lists with no duplicates", () => {
+        expect(_1.PGP_EVEN_WORDS).toHaveLength(256);
+        expect(_1.PGP_ODD_WORDS).toHaveLength(256);
+        expect(new Set([..._1.PGP_EVEN_WORDS, ..._1.PGP_ODD_WORDS]).size).toBe(512);
     });
-    it("rejects malformed, expired, unknown-version, and overlong invitations", () => {
-        const invitation = (0, _1.createDevicePairingInvitation)({
-            serviceOrigin: "https://peers.app",
-            now: NOW,
+    it("generates even/odd/even words and round-trips through formatting and parsing", () => {
+        const words = (0, _1.generatePairingWords)();
+        expect(_1.PGP_EVEN_WORDS).toContain(words[0]);
+        expect(_1.PGP_ODD_WORDS).toContain(words[1]);
+        expect(_1.PGP_EVEN_WORDS).toContain(words[2]);
+        const text = (0, _1.formatPairingCode)(7, words);
+        expect(text).toBe(`7-${words.join("-")}`);
+        expect((0, _1.parsePairingCode)(text)).toEqual({ nameplate: 7, words });
+        expect((0, _1.parsePairingCode)(`  7 ${words.join(" ").toUpperCase()} `)).toEqual({
+            nameplate: 7,
+            words,
         });
-        expect(() => (0, _1.parseDevicePairingInvitation)("not-an-invitation", NOW)).toThrow();
-        expect(() => (0, _1.parseDevicePairingInvitation)((0, _1.encodeDevicePairingInvitation)(invitation), NOW + 300_001)).toThrow();
-        expect(() => (0, _1.parseDevicePairingInvitation)((0, _1.encodeDevicePairingInvitation)({ ...invitation, version: 2 }), NOW)).toThrow();
-        expect(() => (0, _1.createDevicePairingInvitation)({
-            serviceOrigin: "https://peers.app",
-            now: NOW,
-            ttlMs: 300_001,
-        })).toThrow();
     });
-    it("accepts only the configured bounded future clock skew", () => {
-        const skewedInvitation = (0, _1.createDevicePairingInvitation)({
-            serviceOrigin: "https://peers.app",
-            now: NOW + _1.DEVICE_PAIRING_CLOCK_SKEW_MS,
-        });
-        expect((0, _1.parseDevicePairingInvitation)((0, _1.encodeDevicePairingInvitation)(skewedInvitation), NOW)).toEqual(skewedInvitation);
-        expect(() => (0, _1.parseDevicePairingInvitation)((0, _1.encodeDevicePairingInvitation)({
-            ...skewedInvitation,
-            expiresAt: skewedInvitation.expiresAt + 1,
-        }), NOW)).toThrow();
+    it("rejects wrong slots, unknown words, bad nameplates, and wrong lengths", () => {
+        expect(() => (0, _1.parsePairingCode)("7-adroitness-aardvark-absurd")).toThrow(/word 1/);
+        expect(() => (0, _1.parsePairingCode)("7-aardvark-absurd-acme")).toThrow(/word 2/);
+        expect(() => (0, _1.parsePairingCode)("7-aardvark-adroitness-nope")).toThrow(/word 3/);
+        expect(() => (0, _1.parsePairingCode)("0-aardvark-adroitness-acme")).toThrow(/room number/);
+        expect(() => (0, _1.parsePairingCode)("10000-aardvark-adroitness-acme")).toThrow(/room number/);
+        expect(() => (0, _1.parsePairingCode)("aardvark-adroitness-acme")).toThrow(/three words/);
+        expect(() => (0, _1.parsePairingCode)("7-aardvark-adroitness")).toThrow(/three words/);
     });
 });
-describe("device pairing signaling", () => {
-    it("authenticates signaling and rejects modification, role substitution, and replay", () => {
-        const invitation = (0, _1.createDevicePairingInvitation)({
-            serviceOrigin: "https://peers.app",
-            now: NOW,
-        });
-        const signalingKey = (0, _1.derivePairingSignalingKey)(invitation.roomSecret);
-        const offerSdp = `v=0\r\na=fingerprint:sha-256 ${FINGERPRINT}\r\n`;
-        const signal = (0, _1.signPairingSignal)({
-            version: 1,
-            roomId: invitation.roomId,
+describe("pairing PAKE and signaling", () => {
+    const code = (0, _1.parsePairingCode)("42-aardvark-adroitness-acme");
+    it("derives matching keys for the same code and different keys for a wrong code", () => {
+        const source = (0, _1.startPairingPake)("source", code, ORIGIN);
+        const destination = (0, _1.startPairingPake)("destination", code, ORIGIN);
+        const sourceKeys = source.finish(destination.share);
+        const destinationKeys = destination.finish(source.share);
+        expect(sourceKeys).toEqual(destinationKeys);
+        expect(sourceKeys.signalingKey).not.toBe(sourceKeys.confirmKey);
+        const token = (0, _1.derivePairingWebSocketToken)(sourceKeys.signalingKey);
+        expect(token).toBe((0, _1.derivePairingWebSocketToken)(destinationKeys.signalingKey));
+        expect(token).not.toBe(sourceKeys.signalingKey);
+        expect(token).not.toBe(sourceKeys.confirmKey);
+        const wrong = (0, _1.startPairingPake)("source", (0, _1.parsePairingCode)("42-absurd-adroitness-acme"), ORIGIN);
+        const honest = (0, _1.startPairingPake)("destination", code, ORIGIN);
+        expect(wrong.finish(honest.share)).not.toEqual(honest.finish(wrong.share));
+        const otherRoom = (0, _1.startPairingPake)("source", { ...code, nameplate: 43 }, ORIGIN);
+        const thisRoom = (0, _1.startPairingPake)("destination", code, ORIGIN);
+        expect(otherRoom.finish(thisRoom.share)).not.toEqual(thisRoom.finish(otherRoom.share));
+    });
+    it("accepts the pake share unauthenticated and everything else only with the key", () => {
+        const share = (0, _1.startPairingPake)("source", code, ORIGIN).share;
+        const pake = (0, _1.createPairingPakeSignal)({
+            nameplate: 42,
             senderRole: "source",
             sequence: 1,
-            kind: "offer",
+            share,
+        });
+        expect((0, _1.verifyPairingSignal)(pake, undefined, {
+            nameplate: 42,
+            senderRole: "source",
+            nextSequence: 1,
+        })).toEqual(pake);
+        const keys = (0, _1.startPairingPake)("destination", code, ORIGIN);
+        const signalingKey = keys.finish(share).signalingKey;
+        const options = (0, _1.signPairingSignal)({
+            version: 3,
+            nameplate: 42,
+            senderRole: "destination",
+            sequence: 2,
+            kind: "transport-options",
             payload: {
-                type: "offer",
-                sdp: offerSdp,
                 endpointNonce: (0, keys_1.newToken)(32),
+                webrtc: false,
+                websocket: { urls: ["http://192.168.1.20:3341", "wss://peers.example.com"] },
             },
         }, signalingKey);
-        expect((0, _1.verifyPairingSignal)(signal, signalingKey, {
-            roomId: invitation.roomId,
-            senderRole: "source",
-            nextSequence: 1,
-        })).toEqual(signal);
-        expect(() => (0, _1.verifyPairingSignal)({ ...signal, payload: { ...signal.payload, sdp: `${offerSdp}modified` } }, signalingKey, {
-            roomId: invitation.roomId,
-            senderRole: "source",
-            nextSequence: 1,
-        })).toThrow();
-        expect(() => (0, _1.verifyPairingSignal)(signal, signalingKey, {
-            roomId: invitation.roomId,
+        expect((0, _1.verifyPairingSignal)(options, signalingKey, {
+            nameplate: 42,
             senderRole: "destination",
-            nextSequence: 1,
-        })).toThrow();
-        expect(() => (0, _1.verifyPairingSignal)(signal, signalingKey, {
-            roomId: invitation.roomId,
+            nextSequence: 2,
+        })).toEqual(options);
+        expect(() => (0, _1.signPairingSignal)({
+            ...options,
+            payload: { ...options.payload, websocket: { urls: ["ftp://nope"] } },
+        }, signalingKey)).toThrow();
+        const choice = (0, _1.signPairingSignal)({
+            version: 3,
+            nameplate: 42,
+            senderRole: "source",
+            sequence: 2,
+            kind: "transport-choice",
+            payload: { endpointNonce: (0, keys_1.newToken)(32), selected: "ws", url: "http://192.168.1.20:3341" },
+        }, signalingKey);
+        expect((0, _1.verifyPairingSignal)(choice, signalingKey, {
+            nameplate: 42,
             senderRole: "source",
             nextSequence: 2,
-        })).toThrow();
+        })).toEqual(choice);
+        const offerSdp = `v=0\r\na=fingerprint:sha-256 ${FINGERPRINT}\r\n`;
+        const signal = (0, _1.signPairingSignal)({
+            version: 3,
+            nameplate: 42,
+            senderRole: "source",
+            sequence: 3,
+            kind: "offer",
+            payload: { type: "offer", sdp: offerSdp },
+        }, signalingKey);
+        const expected = { nameplate: 42, senderRole: "source", nextSequence: 3 };
+        expect((0, _1.verifyPairingSignal)(signal, signalingKey, expected)).toEqual(signal);
+        expect(() => (0, _1.verifyPairingSignal)(signal, undefined, expected)).toThrow(/before authentication/);
+        expect(() => (0, _1.verifyPairingSignal)({ ...signal, payload: { ...signal.payload, sdp: `${offerSdp}modified` } }, signalingKey, expected)).toThrow(/authentication failed/);
+        expect(() => (0, _1.verifyPairingSignal)(signal, signalingKey, { ...expected, senderRole: "destination" })).toThrow(/out of order/);
+        expect(() => (0, _1.verifyPairingSignal)(signal, signalingKey, { ...expected, nextSequence: 4 })).toThrow(/out of order/);
+        expect(() => (0, _1.verifyPairingSignal)(signal, signalingKey, { ...expected, nameplate: 41 })).toThrow(/out of order/);
     });
 });
-describe("device pairing transcript and credentials", () => {
-    it("derives a stable transcript SAS that changes with SDP", () => {
-        const invitation = (0, _1.createDevicePairingInvitation)({
-            serviceOrigin: "https://peers.app",
-            now: NOW,
-        });
-        const source = new device_1.Device();
-        const destination = new device_1.Device();
-        const transcript = {
-            version: 1,
-            roomId: invitation.roomId,
-            sourceIdentity: (0, keys_1.openSignedObject)(source.getDeviceInfo()),
-            destinationIdentity: (0, keys_1.openSignedObject)(destination.getDeviceInfo()),
-            sourceEndpointNonce: (0, keys_1.newToken)(32),
-            destinationEndpointNonce: (0, keys_1.newToken)(32),
-            offerFingerprint: (0, _1.extractSha256SdpFingerprint)(`v=0\r\na=fingerprint:sha-256 ${FINGERPRINT}\r\n`),
-            answerFingerprint: (0, _1.extractSha256SdpFingerprint)(`v=0\r\na=fingerprint:sha-256 ${FINGERPRINT}\r\n`),
-        };
+describe("pairing transcript, confirmation, and credentials", () => {
+    const source = new device_1.Device();
+    const destination = new device_1.Device();
+    const sdp = `v=0\r\na=fingerprint:sha-256 ${FINGERPRINT}\r\n`;
+    const transcript = {
+        version: 3,
+        serviceOrigin: ORIGIN,
+        nameplate: 42,
+        sourceIdentity: (0, keys_1.openSignedObject)(source.getDeviceInfo()),
+        destinationIdentity: (0, keys_1.openSignedObject)(destination.getDeviceInfo()),
+        sourceEndpointNonce: (0, keys_1.newToken)(32),
+        destinationEndpointNonce: (0, keys_1.newToken)(32),
+        transport: "wrtc",
+        transportBinding: (0, _1.webRtcPairingTransportBinding)(sdp, sdp),
+    };
+    it("hashes the transcript deterministically and changes with any input", () => {
         const hash = (0, _1.computeDevicePairingTranscriptHash)(transcript);
-        const sas = (0, _1.deriveDevicePairingSas)(invitation.roomSecret, hash);
-        const changedHash = (0, _1.computeDevicePairingTranscriptHash)({
+        expect((0, _1.computeDevicePairingTranscriptHash)(transcript)).toBe(hash);
+        expect((0, _1.computeDevicePairingTranscriptHash)({ ...transcript, nameplate: 43 })).not.toBe(hash);
+        expect(transcript.transportBinding).toBe(`${(0, _1.extractSha256SdpFingerprint)(sdp)}|${(0, _1.extractSha256SdpFingerprint)(sdp)}`);
+        expect((0, _1.computeDevicePairingTranscriptHash)({
             ...transcript,
-            answerFingerprint: FINGERPRINT.replace("00", "FF"),
-        });
-        expect(sas).toMatch(/^\d{6}$/);
-        expect((0, _1.deriveDevicePairingSas)(invitation.roomSecret, hash)).toBe(sas);
-        expect((0, _1.deriveDevicePairingSas)(invitation.roomSecret, changedHash)).not.toBe(sas);
+            transportBinding: transcript.transportBinding.replace("00", "FF"),
+        })).not.toBe(hash);
+        expect((0, _1.computeDevicePairingTranscriptHash)({
+            ...transcript,
+            transport: "ws",
+            transportBinding: "http://192.168.1.20:3341",
+        })).not.toBe(hash);
     });
-    it("requires the expected identities and transcript for approval, credentials, and receipt", () => {
-        const source = new device_1.Device();
-        const destination = new device_1.Device();
-        const transcriptHash = (0, keys_1.newToken)(32);
-        const expiresAt = NOW + 60_000;
-        const approval = (0, _1.createSignedPairingApproval)(destination, "destination", transcriptHash, expiresAt);
-        expect((0, _1.verifySignedPairingApproval)(approval, {
-            publicKey: destination.publicKey,
-            transcriptHash,
+    it("confirms only with the same key, role, transcript, and identity", () => {
+        const code = (0, _1.parsePairingCode)("42-aardvark-adroitness-acme");
+        const sourcePake = (0, _1.startPairingPake)("source", code, ORIGIN);
+        const destinationPake = (0, _1.startPairingPake)("destination", code, ORIGIN);
+        const keys = sourcePake.finish(destinationPake.share);
+        const wrongKeys = (0, _1.startPairingPake)("destination", (0, _1.parsePairingCode)("42-absurd-adroitness-acme"), ORIGIN).finish((0, _1.startPairingPake)("source", code, ORIGIN).share);
+        const transcriptHash = (0, _1.computeDevicePairingTranscriptHash)(transcript);
+        const confirmation = (0, _1.createPairingConfirmation)({
             role: "destination",
-            now: NOW,
-        })).toHaveLength(43);
-        expect(() => (0, _1.verifySignedPairingApproval)(approval, {
-            publicKey: source.publicKey,
             transcriptHash,
+            device: transcript.destinationIdentity,
+            presentation: { deviceName: "Phone", deviceType: "mobile" },
+        }, keys.confirmKey);
+        const expected = {
             role: "destination",
-            now: NOW,
-        })).toThrow();
+            transcriptHash,
+            device: transcript.destinationIdentity,
+        };
+        expect((0, _1.verifyPairingConfirmation)(confirmation, keys.confirmKey, expected)).toEqual(confirmation);
+        expect(() => (0, _1.verifyPairingConfirmation)(confirmation, wrongKeys.confirmKey, expected)).toThrow(/did not match/);
+        expect(() => (0, _1.verifyPairingConfirmation)(confirmation, keys.confirmKey, { ...expected, role: "source" })).toThrow(/does not match/);
+        expect(() => (0, _1.verifyPairingConfirmation)(confirmation, keys.confirmKey, {
+            ...expected,
+            device: transcript.sourceIdentity,
+        })).toThrow(/identity mismatch/);
+        expect(() => (0, _1.verifyPairingConfirmation)({ ...confirmation, presentation: { deviceName: "Evil" } }, keys.confirmKey, expected)).toThrow(/did not match/);
+    });
+    it("requires the expected identities and transcript for credentials and receipt", () => {
+        const transcriptHash = (0, keys_1.newToken)(32);
+        const expiresAt = NOW + 60_000;
         const credentials = { userId: (0, utils_1.newid)(), secretKey: (0, keys_1.newKeys)().secretKey };
         const destinationInfo = (0, keys_1.openSignedObject)(destination.getDeviceInfo());
         const envelope = (0, _1.createPairingCredentialEnvelope)(source, destinationInfo, credentials, transcriptHash, expiresAt);
@@ -144,12 +193,7 @@ describe("device pairing transcript and credentials", () => {
             sourcePublicBoxKey: source.publicBoxKey,
             transcriptHash,
             now: NOW,
-        })).toEqual({
-            version: 1,
-            transcriptHash,
-            expiresAt,
-            ...credentials,
-        });
+        })).toEqual({ version: 3, transcriptHash, expiresAt, ...credentials });
         expect(() => (0, _1.openPairingCredentialEnvelope)(new device_1.Device(), envelope, {
             sourcePublicKey: source.publicKey,
             sourcePublicBoxKey: source.publicBoxKey,
@@ -164,11 +208,4 @@ describe("device pairing transcript and credentials", () => {
             transcriptHash,
         })).toEqual(initializedInfo);
     });
-    it("derives independent room-access and signaling credentials", () => {
-        const invitation = (0, _1.createDevicePairingInvitation)({
-            serviceOrigin: "https://peers.app",
-            now: NOW,
-        });
-        expect((0, _1.derivePairingRoomAccessToken)(invitation.roomSecret)).not.toBe((0, _1.derivePairingSignalingKey)(invitation.roomSecret));
-    });
 });

package/dist/device-pairing/index.d.ts

@@ -1,6 +1,8 @@
 export * from "./constants";
+export * from "./cpace";
 export * from "./crypto";
-export * from "./invitation";
+export * from "./pairing-code";
+export * from "./pgp-word-list";
 export * from "./signaling";
 export * from "./transcript";
 export * from "./types";

package/dist/device-pairing/index.js

@@ -15,8 +15,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./constants"), exports);
+__exportStar(require("./cpace"), exports);
 __exportStar(require("./crypto"), exports);
-__exportStar(require("./invitation"), exports);
+__exportStar(require("./pairing-code"), exports);
+__exportStar(require("./pgp-word-list"), exports);
 __exportStar(require("./signaling"), exports);
 __exportStar(require("./transcript"), exports);
 __exportStar(require("./types"), exports);

package/dist/device-pairing/pairing-code.d.ts

@@ -0,0 +1,27 @@
+/** Number of words in a pairing code; each carries one full random byte (24 bits total). */
+export declare const PAIRING_CODE_WORD_COUNT = 3;
+/** The three password words of a pairing code, drawn even/odd/even from the PGP word list. */
+export type PairingWords = readonly [string, string, string];
+/** Parsed `<nameplate>-<word>-<word>-<word>` pairing code. */
+export interface PairingCode {
+    /** Small integer selecting the rendezvous room; not part of the PAKE password. */
+    nameplate: number;
+    /** Lowercase canonical words that form the PAKE password. */
+    words: PairingWords;
+}
+/** Samples three words, one uniformly random byte each, alternating even/odd/even lists. */
+export declare function generatePairingWords(): PairingWords;
+/** Formats the code shown to the user and encoded in the QR: `7-guitar-revenge-tunnel`. */
+export declare function formatPairingCode(nameplate: number, words: PairingWords): string;
+/**
+ * Parses typed or scanned input. Case-insensitive; hyphen or whitespace separated; a word
+ * from the wrong list for its position is rejected immediately (before any network use).
+ * @throws with a generic message that never echoes the input
+ */
+export declare function parsePairingCode(text: string): PairingCode;
+/** PAKE password bytes: the canonical lowercase words joined by hyphens (nameplate excluded). */
+export declare function pairingPasswordFromCode(code: PairingCode): Uint8Array;
+/** PAKE channel identifier binding the exchange to one rendezvous service and room. */
+export declare function pairingChannelId(serviceOrigin: string, nameplate: number): Uint8Array;
+/** Returns whether a nameplate is a positive integer within the service pool. */
+export declare function isValidNameplate(value: number): boolean;

package/dist/device-pairing/pairing-code.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PAIRING_CODE_WORD_COUNT = void 0;
+exports.generatePairingWords = generatePairingWords;
+exports.formatPairingCode = formatPairingCode;
+exports.parsePairingCode = parsePairingCode;
+exports.pairingPasswordFromCode = pairingPasswordFromCode;
+exports.pairingChannelId = pairingChannelId;
+exports.isValidNameplate = isValidNameplate;
+const nacl = require("tweetnacl");
+const constants_1 = require("./constants");
+const cpace_1 = require("./cpace");
+const pgp_word_list_1 = require("./pgp-word-list");
+/** Number of words in a pairing code; each carries one full random byte (24 bits total). */
+exports.PAIRING_CODE_WORD_COUNT = 3;
+const textEncoder = new TextEncoder();
+const EVEN_INDEX = new Map(pgp_word_list_1.PGP_EVEN_WORDS.map((word, index) => [word, index]));
+const ODD_INDEX = new Map(pgp_word_list_1.PGP_ODD_WORDS.map((word, index) => [word, index]));
+function wordListForPosition(position) {
+    return position % 2 === 0 ? pgp_word_list_1.PGP_EVEN_WORDS : pgp_word_list_1.PGP_ODD_WORDS;
+}
+function wordIndexForPosition(position) {
+    return position % 2 === 0 ? EVEN_INDEX : ODD_INDEX;
+}
+/** Samples three words, one uniformly random byte each, alternating even/odd/even lists. */
+function generatePairingWords() {
+    const bytes = nacl.randomBytes(exports.PAIRING_CODE_WORD_COUNT);
+    return [
+        wordListForPosition(0)[bytes[0]],
+        wordListForPosition(1)[bytes[1]],
+        wordListForPosition(2)[bytes[2]],
+    ];
+}
+/** Formats the code shown to the user and encoded in the QR: `7-guitar-revenge-tunnel`. */
+function formatPairingCode(nameplate, words) {
+    assertNameplate(nameplate);
+    return [String(nameplate), ...words].join("-");
+}
+/**
+ * Parses typed or scanned input. Case-insensitive; hyphen or whitespace separated; a word
+ * from the wrong list for its position is rejected immediately (before any network use).
+ * @throws with a generic message that never echoes the input
+ */
+function parsePairingCode(text) {
+    const parts = text
+        .trim()
+        .toLowerCase()
+        .split(/[\s-]+/)
+        .filter((part) => part.length > 0);
+    if (parts.length !== exports.PAIRING_CODE_WORD_COUNT + 1) {
+        throw new Error("Pairing code must be a number followed by three words");
+    }
+    const nameplate = Number.parseInt(parts[0], 10);
+    if (!/^\d+$/.test(parts[0]) || !isValidNameplate(nameplate)) {
+        throw new Error("Pairing code has an invalid room number");
+    }
+    const words = [];
+    for (let position = 0; position < exports.PAIRING_CODE_WORD_COUNT; position++) {
+        const word = parts[position + 1];
+        if (!wordIndexForPosition(position).has(word)) {
+            throw new Error(`Pairing code word ${position + 1} is not recognized`);
+        }
+        words.push(word);
+    }
+    return { nameplate, words: words };
+}
+/** PAKE password bytes: the canonical lowercase words joined by hyphens (nameplate excluded). */
+function pairingPasswordFromCode(code) {
+    return textEncoder.encode(code.words.join("-"));
+}
+/** PAKE channel identifier binding the exchange to one rendezvous service and room. */
+function pairingChannelId(serviceOrigin, nameplate) {
+    assertNameplate(nameplate);
+    return (0, cpace_1.cpaceLvCat)(textEncoder.encode("peers-device-pairing"), textEncoder.encode(serviceOrigin), textEncoder.encode(String(nameplate)));
+}
+/** Returns whether a nameplate is a positive integer within the service pool. */
+function isValidNameplate(value) {
+    return Number.isInteger(value) && value >= 1 && value <= constants_1.DEVICE_PAIRING_MAX_NAMEPLATE;
+}
+function assertNameplate(value) {
+    if (!isValidNameplate(value)) {
+        throw new Error("Invalid pairing nameplate");
+    }
+}

package/dist/device-pairing/pgp-word-list.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The PGP word list: 256 two-syllable "even" words and 256 three-syllable "odd" words.
+ *
+ * Word `n` in each list encodes the byte value `n`. Pairing codes alternate lists by
+ * position (even, odd, even) so a word typed in the wrong slot is detected before the
+ * PAKE runs. The list was designed for reading aloud: words are phonetically distinct
+ * and stress-pattern distinct across the two lists.
+ *
+ * Source: https://en.wikipedia.org/wiki/PGP_word_list (lowercased).
+ */
+/** Two-syllable words used for byte positions 0 and 2 of a pairing code. */
+export declare const PGP_EVEN_WORDS: readonly string[];
+/** Three-syllable words used for byte position 1 of a pairing code. */
+export declare const PGP_ODD_WORDS: readonly string[];