@viewportai/daemon 0.1.0 → 0.2.1

package/dist/server/pairing-offers.js

@@ -1,26 +1,19 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
-import path from 'node:path';
 import { configDir } from '../core/config.js';
+import { logger } from '../core/logger.js';
+import { appendPairingAudit, authTokenPath, pairingStorePath } from './pairing-file-store.js';
+import { getOrCreateDaemonIdentity, getOrCreateTrustAnchor, readDaemonIdentity, } from './pairing-identity-store.js';
+import { deriveRelayPairingSecret, hashPairingSecret, peerIdFromPublicKey, upsertPeerBinding, } from './pairing-peer-bindings.js';
+const log = logger.child({ module: 'pairing-offers' });
+export { getOrCreateDaemonIdentity, getOrCreateTrustAnchor } from './pairing-identity-store.js';
 const MAX_STORED_OFFERS = 200;
 const MAX_FAILED_REDEEM_ATTEMPTS = 5;
-function pairingStorePath() {
-    return path.join(configDir(), 'pairing-offers.json');
-}
-function pairingAuditPath() {
-    return path.join(configDir(), 'pairing-audit.jsonl');
-}
-function authTokenPath() {
-    return path.join(configDir(), 'auth-token');
-}
-function trustAnchorPath() {
-    return path.join(configDir(), 'pairing-trust-anchor.json');
-}
-function daemonIdentityPath() {
-    return path.join(configDir(), 'pairing-device-identity.json');
-}
-function peerBindingPath() {
-    return path.join(configDir(), 'pairing-peers.json');
+let storeMutationLock = Promise.resolve();
+function withStoreMutationLock(operation) {
+    const run = storeMutationLock.then(operation, operation);
+    storeMutationLock = run.then(() => undefined, () => undefined);
+    return run;
 }
 async function readStore() {
     try {
@@ -41,7 +34,14 @@ async function readStore() {
 async function writeStore(store) {
     await fs.mkdir(configDir(), { recursive: true });
     const compacted = compactOffers(store.offers);
-    await fs.writeFile(pairingStorePath(), JSON.stringify({ version: 1, offers: compacted }, null, 2) + '\n', 'utf-8');
+    const sanitized = compacted.map((offer) => {
+        const { token: _legacyToken, ...rest } = offer;
+        return rest;
+    });
+    await fs.writeFile(pairingStorePath(), JSON.stringify({ version: 1, offers: sanitized }, null, 2) + '\n', {
+        encoding: 'utf-8',
+        mode: 0o600,
+    });
 }
 function compactOffers(offers) {
     const now = Date.now();
@@ -55,127 +55,6 @@ function compactOffers(offers) {
         return fresh;
     return fresh.slice(fresh.length - MAX_STORED_OFFERS);
 }
-async function appendAudit(event) {
-    await fs.mkdir(configDir(), { recursive: true });
-    const line = JSON.stringify({ timestamp: Date.now(), ...event });
-    await fs.appendFile(pairingAuditPath(), `${line}\n`, 'utf-8');
-}
-function trustAnchorFingerprint(secret) {
-    const digest = crypto.createHash('sha256').update(secret).digest('hex');
-    return digest.match(/.{1,4}/g)?.join(':') ?? digest;
-}
-function keyFingerprint(publicKey) {
-    const digest = crypto.createHash('sha256').update(publicKey).digest('hex');
-    return digest.match(/.{1,4}/g)?.join(':') ?? digest;
-}
-async function readTrustAnchorRecord() {
-    try {
-        const raw = await fs.readFile(trustAnchorPath(), 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (parsed &&
-            parsed.version === 1 &&
-            typeof parsed.id === 'string' &&
-            typeof parsed.createdAt === 'number' &&
-            typeof parsed.secret === 'string' &&
-            parsed.secret.length > 0) {
-            return parsed;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-async function writeTrustAnchorRecord(record) {
-    await fs.mkdir(configDir(), { recursive: true });
-    await fs.writeFile(trustAnchorPath(), JSON.stringify(record, null, 2) + '\n', {
-        mode: 0o600,
-    });
-}
-export async function getOrCreateTrustAnchor() {
-    const existing = await readTrustAnchorRecord();
-    if (existing) {
-        return {
-            id: existing.id,
-            createdAt: existing.createdAt,
-            fingerprint: trustAnchorFingerprint(existing.secret),
-        };
-    }
-    const created = {
-        version: 1,
-        id: crypto.randomUUID(),
-        createdAt: Date.now(),
-        secret: crypto.randomBytes(32).toString('hex'),
-    };
-    await writeTrustAnchorRecord(created);
-    await appendAudit({
-        event: 'pair_trust_anchor_created',
-        trustAnchorId: created.id,
-        trustAnchor: trustAnchorFingerprint(created.secret),
-    });
-    return {
-        id: created.id,
-        createdAt: created.createdAt,
-        fingerprint: trustAnchorFingerprint(created.secret),
-    };
-}
-async function readDaemonIdentity() {
-    try {
-        const raw = await fs.readFile(daemonIdentityPath(), 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (parsed &&
-            parsed.version === 1 &&
-            typeof parsed.deviceId === 'string' &&
-            typeof parsed.createdAt === 'number' &&
-            typeof parsed.publicKey === 'string' &&
-            typeof parsed.privateKey === 'string') {
-            return parsed;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-async function writeDaemonIdentity(identity) {
-    await fs.mkdir(configDir(), { recursive: true });
-    await fs.writeFile(daemonIdentityPath(), JSON.stringify(identity, null, 2) + '\n', {
-        mode: 0o600,
-    });
-}
-export async function getOrCreateDaemonIdentity() {
-    const existing = await readDaemonIdentity();
-    if (existing) {
-        return {
-            deviceId: existing.deviceId,
-            createdAt: existing.createdAt,
-            fingerprint: keyFingerprint(existing.publicKey),
-            publicKey: existing.publicKey,
-        };
-    }
-    const keypair = crypto.generateKeyPairSync('ed25519');
-    const publicKey = keypair.publicKey.export({ type: 'spki', format: 'pem' }).toString().trim();
-    const privateKey = keypair.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString().trim();
-    const created = {
-        version: 1,
-        deviceId: crypto.randomUUID(),
-        createdAt: Date.now(),
-        publicKey,
-        privateKey,
-    };
-    await writeDaemonIdentity(created);
-    await appendAudit({
-        event: 'pair_device_identity_created',
-        deviceId: created.deviceId,
-        fingerprint: keyFingerprint(created.publicKey),
-    });
-    return {
-        deviceId: created.deviceId,
-        createdAt: created.createdAt,
-        fingerprint: keyFingerprint(created.publicKey),
-        publicKey: created.publicKey,
-    };
-}
 function canonicalRedeemPayload(input) {
     return [
         'viewport-pair-redeem-v1',
@@ -185,56 +64,7 @@ function canonicalRedeemPayload(input) {
         input.clientPublicKey,
     ].join('\n');
 }
-function peerIdFromPublicKey(publicKey) {
-    return crypto.createHash('sha256').update(publicKey).digest('hex');
-}
-async function readPeerBindings() {
-    try {
-        const raw = await fs.readFile(peerBindingPath(), 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (!parsed || parsed.version !== 1 || !Array.isArray(parsed.peers)) {
-            return { version: 1, peers: [] };
-        }
-        return {
-            version: 1,
-            peers: parsed.peers.filter((item) => item &&
-                typeof item.peerId === 'string' &&
-                typeof item.publicKey === 'string' &&
-                typeof item.firstPairedAt === 'number'),
-        };
-    }
-    catch {
-        return { version: 1, peers: [] };
-    }
-}
-async function writePeerBindings(store) {
-    await fs.mkdir(configDir(), { recursive: true });
-    await fs.writeFile(peerBindingPath(), JSON.stringify(store, null, 2) + '\n', {
-        mode: 0o600,
-    });
-}
-async function upsertPeerBinding(input) {
-    const store = await readPeerBindings();
-    const now = Date.now();
-    const existing = store.peers.find((peer) => peer.peerId === input.peerId);
-    if (existing) {
-        existing.publicKey = input.publicKey;
-        existing.lastPairedAt = now;
-        existing.lastOfferId = input.offerId;
-        existing.trustAnchor = input.trustAnchor;
-    }
-    else {
-        store.peers.push({
-            peerId: input.peerId,
-            publicKey: input.publicKey,
-            firstPairedAt: now,
-            lastPairedAt: now,
-            lastOfferId: input.offerId,
-            trustAnchor: input.trustAnchor,
-        });
-    }
-    await writePeerBindings(store);
-}
+export { resolveRelayPairingSecret } from './pairing-peer-bindings.js';
 export function createPairingClientIdentity() {
     const keypair = crypto.generateKeyPairSync('ed25519');
     const publicKey = keypair.publicKey.export({ type: 'spki', format: 'pem' }).toString().trim();
@@ -275,228 +105,247 @@ export async function rotateAuthToken() {
     const token = crypto.randomBytes(32).toString('hex');
     await fs.mkdir(configDir(), { recursive: true });
     await fs.writeFile(authTokenPath(), `${token}\n`, { mode: 0o600 });
-    await appendAudit({ event: 'auth_token_rotated' });
+    await appendPairingAudit({ event: 'auth_token_rotated' });
     return { token, previousTokenExisted: previous !== null };
 }
 export async function issuePairingOffer(input) {
-    const ttlSeconds = Math.min(3600, Math.max(30, Math.floor(input.ttlSeconds)));
-    const createdAt = Date.now();
-    const expiresAt = createdAt + ttlSeconds * 1000;
-    const offerId = crypto.randomUUID();
-    const redeemSecret = crypto.randomBytes(16).toString('hex');
-    const token = await readAuthToken();
-    if (!token) {
-        throw new Error('No auth token available for pairing offer');
-    }
-    const trustAnchor = await getOrCreateTrustAnchor();
-    const daemonIdentity = await getOrCreateDaemonIdentity();
-    const store = await readStore();
-    store.offers.push({
-        offerId,
-        createdAt,
-        expiresAt,
-        redeemSecretHash: hashSecret(redeemSecret),
-        token,
-        trustAnchor: trustAnchor.fingerprint,
-        daemonDeviceId: daemonIdentity.deviceId,
-        daemonPublicKey: daemonIdentity.publicKey,
-        connection: input.connection,
-    });
-    await writeStore(store);
-    await appendAudit({
-        event: 'pair_offer_issued',
-        offerId,
-        createdAt,
-        expiresAt,
-        profile: input.connection.profile,
-        listen: input.connection.listen,
-        trustAnchor: trustAnchor.fingerprint,
-        daemonDeviceId: daemonIdentity.deviceId,
+    return await withStoreMutationLock(async () => {
+        const ttlSeconds = Math.min(3600, Math.max(30, Math.floor(input.ttlSeconds)));
+        const createdAt = Date.now();
+        const expiresAt = createdAt + ttlSeconds * 1000;
+        const offerId = crypto.randomUUID();
+        const redeemSecret = crypto.randomBytes(16).toString('hex');
+        const existingToken = await readAuthToken();
+        if (!existingToken) {
+            await rotateAuthToken();
+        }
+        const trustAnchor = await getOrCreateTrustAnchor();
+        const daemonIdentity = await getOrCreateDaemonIdentity();
+        const store = await readStore();
+        store.offers.push({
+            offerId,
+            createdAt,
+            expiresAt,
+            redeemSecretHash: await hashPairingSecret(redeemSecret),
+            trustAnchor: trustAnchor.fingerprint,
+            daemonDeviceId: daemonIdentity.deviceId,
+            daemonPublicKey: daemonIdentity.publicKey,
+            connection: input.connection,
+        });
+        await writeStore(store);
+        await appendPairingAudit({
+            event: 'pair_offer_issued',
+            offerId,
+            createdAt,
+            expiresAt,
+            profile: input.connection.profile,
+            listen: input.connection.listen,
+            trustAnchor: trustAnchor.fingerprint,
+            daemonDeviceId: daemonIdentity.deviceId,
+        });
+        return {
+            offerId,
+            createdAt,
+            expiresAt,
+            redeemSecret,
+            trustAnchor: trustAnchor.fingerprint,
+            daemonDeviceId: daemonIdentity.deviceId,
+            daemonPublicKey: daemonIdentity.publicKey,
+            ...input.connection,
+        };
     });
-    return {
-        offerId,
-        createdAt,
-        expiresAt,
-        redeemSecret,
-        trustAnchor: trustAnchor.fingerprint,
-        daemonDeviceId: daemonIdentity.deviceId,
-        daemonPublicKey: daemonIdentity.publicKey,
-        ...input.connection,
-    };
 }
 export async function listPairingOffers() {
-    const store = await readStore();
-    const now = Date.now();
-    return store.offers
-        .map((offer) => {
-        const expired = offer.expiresAt <= now;
-        const active = !expired && !offer.revokedAt && !offer.redeemedAt;
-        return {
-            offerId: offer.offerId,
-            createdAt: offer.createdAt,
-            expiresAt: offer.expiresAt,
-            trustAnchor: offer.trustAnchor,
-            daemonDeviceId: offer.daemonDeviceId,
-            host: offer.connection.host,
-            port: offer.connection.port,
-            listen: offer.connection.listen,
-            socketPath: offer.connection.socketPath,
-            profile: offer.connection.profile,
-            revokedAt: offer.revokedAt,
-            redeemedAt: offer.redeemedAt,
-            active,
-            expired,
-        };
-    })
-        .sort((a, b) => b.createdAt - a.createdAt);
+    return await withStoreMutationLock(async () => {
+        const store = await readStore();
+        const now = Date.now();
+        return store.offers
+            .map((offer) => {
+            const expired = offer.expiresAt <= now;
+            const active = !expired && !offer.revokedAt && !offer.redeemedAt;
+            return {
+                offerId: offer.offerId,
+                createdAt: offer.createdAt,
+                expiresAt: offer.expiresAt,
+                trustAnchor: offer.trustAnchor,
+                daemonDeviceId: offer.daemonDeviceId,
+                host: offer.connection.host,
+                port: offer.connection.port,
+                listen: offer.connection.listen,
+                socketPath: offer.connection.socketPath,
+                profile: offer.connection.profile,
+                revokedAt: offer.revokedAt,
+                redeemedAt: offer.redeemedAt,
+                active,
+                expired,
+            };
+        })
+            .sort((a, b) => b.createdAt - a.createdAt);
+    });
 }
 export async function revokePairingOffer(offerId) {
-    const store = await readStore();
-    const offer = store.offers.find((item) => item.offerId === offerId);
-    if (!offer)
-        return false;
-    if (!offer.revokedAt) {
-        offer.revokedAt = Date.now();
-        await writeStore(store);
-        await appendAudit({ event: 'pair_offer_revoked', offerId: offer.offerId });
-    }
-    return true;
+    return await withStoreMutationLock(async () => {
+        const store = await readStore();
+        const offer = store.offers.find((item) => item.offerId === offerId);
+        if (!offer)
+            return false;
+        if (!offer.revokedAt) {
+            offer.revokedAt = Date.now();
+            await writeStore(store);
+            await appendPairingAudit({ event: 'pair_offer_revoked', offerId: offer.offerId });
+        }
+        return true;
+    });
 }
 export async function redeemPairingOffer(offerId, redeemSecret, expectedTrustAnchor, clientPublicKey, clientProof) {
-    if (!redeemSecret || redeemSecret.trim().length === 0) {
-        return null;
-    }
-    const store = await readStore();
-    const offer = store.offers.find((item) => item.offerId === offerId);
-    if (!offer)
-        return null;
-    const now = Date.now();
-    const expired = offer.expiresAt <= now;
-    if (expired || offer.revokedAt || offer.redeemedAt || offer.lockedAt) {
-        return null;
-    }
-    if (!clientPublicKey || !clientProof) {
-        await appendAudit({
-            event: 'pair_offer_redeem_failed',
-            offerId: offer.offerId,
-            reason: 'missing_client_identity_proof',
-        });
-        return null;
-    }
-    if (expectedTrustAnchor && offer.trustAnchor !== expectedTrustAnchor) {
-        await appendAudit({
-            event: 'pair_offer_redeem_failed',
-            offerId: offer.offerId,
-            reason: 'trust_anchor_mismatch',
-            expectedTrustAnchor,
-            offeredTrustAnchor: offer.trustAnchor,
-        });
-        return null;
-    }
-    try {
-        const payload = canonicalRedeemPayload({
-            offerId: offer.offerId,
-            redeemSecret,
-            trustAnchor: offer.trustAnchor,
-            clientPublicKey,
-        });
-        const verified = crypto.verify(null, Buffer.from(payload, 'utf-8'), crypto.createPublicKey(clientPublicKey), Buffer.from(clientProof, 'base64url'));
-        if (!verified) {
-            await appendAudit({
+    return await withStoreMutationLock(async () => {
+        if (!redeemSecret || redeemSecret.trim().length === 0) {
+            return null;
+        }
+        const store = await readStore();
+        const offer = store.offers.find((item) => item.offerId === offerId);
+        if (!offer)
+            return null;
+        const now = Date.now();
+        const expired = offer.expiresAt <= now;
+        if (expired || offer.revokedAt || offer.redeemedAt || offer.lockedAt) {
+            return null;
+        }
+        if (!clientPublicKey || !clientProof) {
+            await appendPairingAudit({
+                event: 'pair_offer_redeem_failed',
+                offerId: offer.offerId,
+                reason: 'missing_client_identity_proof',
+            });
+            return null;
+        }
+        if (expectedTrustAnchor && offer.trustAnchor !== expectedTrustAnchor) {
+            await appendPairingAudit({
+                event: 'pair_offer_redeem_failed',
+                offerId: offer.offerId,
+                reason: 'trust_anchor_mismatch',
+                expectedTrustAnchor,
+                offeredTrustAnchor: offer.trustAnchor,
+            });
+            return null;
+        }
+        try {
+            const payload = canonicalRedeemPayload({
+                offerId: offer.offerId,
+                redeemSecret,
+                trustAnchor: offer.trustAnchor,
+                clientPublicKey,
+            });
+            const verified = crypto.verify(null, Buffer.from(payload, 'utf-8'), crypto.createPublicKey(clientPublicKey), Buffer.from(clientProof, 'base64url'));
+            if (!verified) {
+                await appendPairingAudit({
+                    event: 'pair_offer_redeem_failed',
+                    offerId: offer.offerId,
+                    reason: 'client_proof_invalid',
+                });
+                return null;
+            }
+        }
+        catch {
+            await appendPairingAudit({
                 event: 'pair_offer_redeem_failed',
                 offerId: offer.offerId,
                 reason: 'client_proof_invalid',
             });
             return null;
         }
-    }
-    catch {
-        await appendAudit({
-            event: 'pair_offer_redeem_failed',
+        if (typeof offer.redeemSecretHash !== 'string' || offer.redeemSecretHash.length === 0) {
+            offer.lockedAt = now;
+            await writeStore(store);
+            await appendPairingAudit({
+                event: 'pair_offer_redeem_failed',
+                offerId: offer.offerId,
+                reason: 'missing_redeem_secret_hash',
+            });
+            return null;
+        }
+        const proofValid = secureSecretCompare(offer.redeemSecretHash, await hashPairingSecret(redeemSecret));
+        if (!proofValid) {
+            offer.failedRedeemAttempts = (offer.failedRedeemAttempts ?? 0) + 1;
+            if (offer.failedRedeemAttempts >= MAX_FAILED_REDEEM_ATTEMPTS) {
+                offer.lockedAt = now;
+            }
+            await writeStore(store);
+            await appendPairingAudit({
+                event: 'pair_offer_redeem_failed',
+                offerId: offer.offerId,
+                attempts: offer.failedRedeemAttempts,
+                locked: !!offer.lockedAt,
+            });
+            return null;
+        }
+        offer.redeemedAt = now;
+        await writeStore(store);
+        const peerId = peerIdFromPublicKey(clientPublicKey);
+        const relayPairingSecret = deriveRelayPairingSecret({
             offerId: offer.offerId,
-            reason: 'client_proof_invalid',
+            redeemSecret,
+            trustAnchor: offer.trustAnchor,
+            clientPublicKey,
+            daemonPublicKey: offer.daemonPublicKey,
         });
-        return null;
-    }
-    if (typeof offer.redeemSecretHash !== 'string' || offer.redeemSecretHash.length === 0) {
-        offer.lockedAt = now;
-        await writeStore(store);
-        await appendAudit({
-            event: 'pair_offer_redeem_failed',
+        await upsertPeerBinding({
+            peerId,
+            publicKey: clientPublicKey,
+            relayPairingSecret,
             offerId: offer.offerId,
-            reason: 'missing_redeem_secret_hash',
+            trustAnchor: offer.trustAnchor,
         });
-        return null;
-    }
-    const proofValid = secureSecretCompare(offer.redeemSecretHash, hashSecret(redeemSecret));
-    if (!proofValid) {
-        offer.failedRedeemAttempts = (offer.failedRedeemAttempts ?? 0) + 1;
-        if (offer.failedRedeemAttempts >= MAX_FAILED_REDEEM_ATTEMPTS) {
-            offer.lockedAt = now;
-        }
-        await writeStore(store);
-        await appendAudit({
-            event: 'pair_offer_redeem_failed',
+        log.debug({
+            peerId,
             offerId: offer.offerId,
-            attempts: offer.failedRedeemAttempts,
-            locked: !!offer.lockedAt,
+            viewportHome: configDir(),
+        }, 'Stored relay pairing peer binding');
+        const daemonIdentity = await readDaemonIdentity();
+        const daemonPrivateKey = daemonIdentity
+            ? crypto.createPrivateKey(daemonIdentity.privateKey)
+            : undefined;
+        const redeemEnvelope = [
+            'viewport-pair-redeem-response-v1',
+            offer.offerId,
+            peerId,
+            offer.trustAnchor,
+            String(offer.expiresAt),
+        ].join('\n');
+        const serverSignature = daemonPrivateKey
+            ? crypto
+                .sign(null, Buffer.from(redeemEnvelope, 'utf-8'), daemonPrivateKey)
+                .toString('base64url')
+            : '';
+        await appendPairingAudit({
+            event: 'pair_offer_redeemed',
+            offerId: offer.offerId,
+            peerId,
+            daemonDeviceId: offer.daemonDeviceId,
         });
-        return null;
-    }
-    offer.redeemedAt = now;
-    await writeStore(store);
-    const peerId = peerIdFromPublicKey(clientPublicKey);
-    await upsertPeerBinding({
-        peerId,
-        publicKey: clientPublicKey,
-        offerId: offer.offerId,
-        trustAnchor: offer.trustAnchor,
-    });
-    const daemonIdentity = await readDaemonIdentity();
-    const daemonPrivateKey = daemonIdentity
-        ? crypto.createPrivateKey(daemonIdentity.privateKey)
-        : undefined;
-    const redeemEnvelope = [
-        'viewport-pair-redeem-response-v1',
-        offer.offerId,
-        peerId,
-        offer.trustAnchor,
-        String(offer.expiresAt),
-    ].join('\n');
-    const serverSignature = daemonPrivateKey
-        ? crypto
-            .sign(null, Buffer.from(redeemEnvelope, 'utf-8'), daemonPrivateKey)
-            .toString('base64url')
-        : '';
-    await appendAudit({
-        event: 'pair_offer_redeemed',
-        offerId: offer.offerId,
-        peerId,
-        daemonDeviceId: offer.daemonDeviceId,
+        return {
+            offerId: offer.offerId,
+            trustAnchor: offer.trustAnchor,
+            daemonDeviceId: offer.daemonDeviceId,
+            daemonPublicKey: offer.daemonPublicKey,
+            peerId,
+            relayPairingPeerId: peerId,
+            serverSignature,
+            connection: offer.connection,
+            expiresAt: offer.expiresAt,
+            createdAt: offer.createdAt,
+        };
     });
-    return {
-        offerId: offer.offerId,
-        token: offer.token,
-        trustAnchor: offer.trustAnchor,
-        daemonDeviceId: offer.daemonDeviceId,
-        daemonPublicKey: offer.daemonPublicKey,
-        peerId,
-        serverSignature,
-        connection: offer.connection,
-        expiresAt: offer.expiresAt,
-        createdAt: offer.createdAt,
-    };
-}
-function hashSecret(secret) {
-    return crypto.createHash('sha256').update(secret).digest('hex');
 }
 function secureSecretCompare(a, b) {
     const left = Buffer.from(a, 'utf-8');
     const right = Buffer.from(b, 'utf-8');
-    if (left.length !== right.length) {
-        crypto.timingSafeEqual(left, left);
-        return false;
-    }
-    return crypto.timingSafeEqual(left, right);
+    const compareLength = Math.max(left.length, right.length, 1);
+    const paddedLeft = Buffer.alloc(compareLength);
+    const paddedRight = Buffer.alloc(compareLength);
+    left.copy(paddedLeft);
+    right.copy(paddedRight);
+    const equal = crypto.timingSafeEqual(paddedLeft, paddedRight);
+    return equal && left.length === right.length;
 }
 //# sourceMappingURL=pairing-offers.js.map