@yefengr/remote-pi 0.9.8 → 0.9.9

package/README.md

@@ -80,6 +80,7 @@ Only `http://` and `https://` are accepted at the command boundary; WebSocket co
 - Pairing and revocation update the Relay endpoint ACL with `authorized_owner_ids`.
 - Relay loss enters reconnecting state; the Extension does not restart Pi to recover.
 - Device private keys, pairing tokens, encrypted payloads, and message bodies are not logged.
+- Concurrent Pi processes coordinate device identity initialization through a local lock. If initialization is interrupted, follow the [identity storage and lock recovery rules](../docs/reference/protocol/pairing.md#host); do not delete identity or pairing data to retry.
 
 ## Migration from older releases
 

package/dist/pairing/identity-keyring.d.ts

@@ -0,0 +1,22 @@
+import { IDENTITY_LOCK_RELEASE_AFTER, type IdentityLockDeferredRelease } from "./identity-lock.js";
+export interface KeyStoreBackend {
+    read(service: string, account: string): Promise<string | undefined>;
+    write(service: string, account: string, value: string): Promise<void>;
+    delete(service: string, account: string): Promise<boolean>;
+}
+export declare class KeyringReadTimeoutError extends Error {
+    constructor(op: string, timeoutMs: number);
+}
+export declare class KeyringMutationTimeoutError extends Error implements IdentityLockDeferredRelease {
+    readonly [IDENTITY_LOCK_RELEASE_AFTER]: Promise<void>;
+    constructor(op: string, timeoutMs: number, settled: Promise<void>);
+}
+export declare function _setKeyringOperationTimeoutForTest(timeoutMs: number | null): void;
+export declare function _runKeyringOperationWithTimeoutForTest<T>(operation: Promise<T>, op: string, mutating: boolean, timeoutMs: number): Promise<T>;
+export declare function nativeBindingUnavailable(): boolean;
+export declare function _setNativeBindingErrorForTest(error: unknown): void;
+export declare class NapiKeyringBackend implements KeyStoreBackend {
+    read(service: string, account: string): Promise<string | undefined>;
+    write(service: string, account: string, value: string): Promise<void>;
+    delete(service: string, account: string): Promise<boolean>;
+}

package/dist/pairing/identity-keyring.js

@@ -0,0 +1,94 @@
+import { IDENTITY_LOCK_RELEASE_AFTER, } from "./identity-lock.js";
+export class KeyringReadTimeoutError extends Error {
+    constructor(op, timeoutMs) {
+        super(`keyring ${op} timed out after ${timeoutMs}ms`);
+        this.name = "KeyringReadTimeoutError";
+    }
+}
+export class KeyringMutationTimeoutError extends Error {
+    [IDENTITY_LOCK_RELEASE_AFTER];
+    constructor(op, timeoutMs, settled) {
+        super(`keyring ${op} timed out after ${timeoutMs}ms; the underlying operation is still pending`);
+        this.name = "KeyringMutationTimeoutError";
+        this[IDENTITY_LOCK_RELEASE_AFTER] = settled.then(() => undefined, () => undefined);
+    }
+}
+let keyringOperationTimeoutMs = 3_000;
+export function _setKeyringOperationTimeoutForTest(timeoutMs) {
+    keyringOperationTimeoutMs = timeoutMs ?? 3_000;
+}
+export function _runKeyringOperationWithTimeoutForTest(operation, op, mutating, timeoutMs) {
+    return withKeyringTimeout(operation, op, mutating, timeoutMs);
+}
+function withKeyringTimeout(operation, op, mutating, timeoutMs = keyringOperationTimeoutMs) {
+    const settled = operation.then(() => undefined, () => undefined);
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(mutating
+                ? new KeyringMutationTimeoutError(op, timeoutMs, settled)
+                : new KeyringReadTimeoutError(op, timeoutMs));
+        }, timeoutMs);
+        operation.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+let asyncEntryCtor = null;
+let nativeBindingError = null;
+async function loadAsyncEntry() {
+    if (asyncEntryCtor)
+        return asyncEntryCtor;
+    if (nativeBindingError)
+        throw nativeBindingError;
+    try {
+        const mod = await import("@napi-rs/keyring");
+        asyncEntryCtor = mod.AsyncEntry;
+        return asyncEntryCtor;
+    }
+    catch (error) {
+        nativeBindingError = error;
+        throw error;
+    }
+}
+export function nativeBindingUnavailable() {
+    return nativeBindingError !== null;
+}
+export function _setNativeBindingErrorForTest(error) {
+    asyncEntryCtor = null;
+    nativeBindingError = error;
+}
+export class NapiKeyringBackend {
+    async read(service, account) {
+        const AsyncEntry = await loadAsyncEntry();
+        const entry = new AsyncEntry(service, account);
+        return withKeyringTimeout(entry.getPassword(), `read(${service})`, false);
+    }
+    async write(service, account, value) {
+        const AsyncEntry = await loadAsyncEntry();
+        const entry = new AsyncEntry(service, account);
+        await withKeyringTimeout(entry.setPassword(value), `write(${service})`, true);
+    }
+    async delete(service, account) {
+        let entry;
+        try {
+            const AsyncEntry = await loadAsyncEntry();
+            entry = new AsyncEntry(service, account);
+        }
+        catch {
+            return false;
+        }
+        try {
+            return await withKeyringTimeout(entry.deleteCredential(), `delete(${service})`, true);
+        }
+        catch (error) {
+            if (error instanceof KeyringMutationTimeoutError)
+                throw error;
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=identity-keyring.js.map

package/dist/pairing/identity-keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-keyring.js","sourceRoot":"","sources":["../../src/pairing/identity-keyring.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAE5B,MAAM,oBAAoB,CAAC;AAQ5B,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,EAAU,EAAE,SAAiB;QACvC,KAAK,CAAC,WAAW,EAAE,oBAAoB,SAAS,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,CAAC,2BAA2B,CAAC,CAAgB;IAEtD,YAAY,EAAU,EAAE,SAAiB,EAAE,OAAsB;QAC/D,KAAK,CAAC,WAAW,EAAE,oBAAoB,SAAS,+CAA+C,CAAC,CAAC;QACjG,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAC,IAAI,CAC9C,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;CACF;AAED,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC,MAAM,UAAU,kCAAkC,CAAC,SAAwB;IACzE,yBAAyB,GAAG,SAAS,IAAI,KAAK,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,SAAqB,EACrB,EAAU,EACV,QAAiB,EACjB,SAAiB;IAEjB,OAAO,kBAAkB,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAqB,EACrB,EAAU,EACV,QAAiB,EACjB,YAAoB,yBAAyB;IAE7C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAC5B,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IAEF,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,QAAQ;gBACb,CAAC,CAAC,IAAI,2BAA2B,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC;gBACzD,CAAC,CAAC,IAAI,uBAAuB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAClD,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,SAAS,CAAC,IAAI,CACZ,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,cAAc,GAAwD,IAAI,CAAC;AAC/E,IAAI,kBAAkB,GAAY,IAAI,CAAC;AAEvC,KAAK,UAAU,cAAc;IAC3B,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,kBAAkB;QAAE,MAAM,kBAAkB,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,cAAc,GAAG,GAAG,CAAC,UAAU,CAAC;QAChC,OAAO,cAAc,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,GAAG,KAAK,CAAC;QAC3B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,kBAAkB,KAAK,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,cAAc,GAAG,IAAI,CAAC;IACtB,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,kBAAkB;IAC7B,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAe;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa;QACzD,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,GAAG,EAAE,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,IAAI,KAAiE,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;YAC1C,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,UAAU,OAAO,GAAG,EAAE,IAAI,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,2BAA2B;gBAAE,MAAM,KAAK,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/pairing/identity-lock.d.ts

@@ -0,0 +1,14 @@
+export declare const IDENTITY_LOCK_RELEASE_AFTER: unique symbol;
+export interface IdentityLockDeferredRelease {
+    readonly [IDENTITY_LOCK_RELEASE_AFTER]: Promise<void>;
+}
+export interface IdentityLockOptions {
+    readonly waitTimeoutMs?: number;
+    readonly pollIntervalMs?: number;
+}
+export declare class IdentityLockTimeoutError extends Error {
+    readonly lockPath: string;
+    constructor(lockPath: string, waitTimeoutMs: number);
+}
+export declare function ensurePrivateIdentityDirectory(directory: string): Promise<void>;
+export declare function withIdentityLock<T>(directory: string, operation: () => Promise<T>, options?: IdentityLockOptions): Promise<T>;

package/dist/pairing/identity-lock.js

@@ -0,0 +1,116 @@
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, open, readFile, unlink } from "node:fs/promises";
+import { join } from "node:path";
+export const IDENTITY_LOCK_RELEASE_AFTER = Symbol("identity-lock-release-after");
+export class IdentityLockTimeoutError extends Error {
+    lockPath;
+    constructor(lockPath, waitTimeoutMs) {
+        super(`Identity initialization lock remained held for ${waitTimeoutMs}ms at ${lockPath}. ` +
+            "Another process may still be initializing the identity, or a previous process may " +
+            "have exited unexpectedly. The lock is never removed automatically. Confirm that no " +
+            "identity initialization or keyring operation is still running before removing it manually.");
+        this.name = "IdentityLockTimeoutError";
+        this.lockPath = lockPath;
+    }
+}
+function isNodeErrorWithCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error &&
+        error.code === code;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function ensurePrivateIdentityDirectory(directory) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700);
+}
+async function tryAcquire(lockPath) {
+    let handle;
+    try {
+        handle = await open(lockPath, "wx", 0o600);
+    }
+    catch (error) {
+        if (isNodeErrorWithCode(error, "EEXIST"))
+            return null;
+        throw error;
+    }
+    const token = randomUUID();
+    try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, token, createdAt: new Date().toISOString() }));
+        await handle.sync();
+        return { handle, path: lockPath, token };
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        await unlink(lockPath).catch(() => undefined);
+        throw error;
+    }
+}
+async function acquireIdentityLock(directory, options) {
+    await ensurePrivateIdentityDirectory(directory);
+    const lockPath = join(directory, "identity.lock");
+    const waitTimeoutMs = options.waitTimeoutMs ?? 15_000;
+    const pollIntervalMs = Math.max(1, options.pollIntervalMs ?? 50);
+    const deadline = Date.now() + Math.max(0, waitTimeoutMs);
+    while (true) {
+        const held = await tryAcquire(lockPath);
+        if (held)
+            return held;
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0)
+            throw new IdentityLockTimeoutError(lockPath, waitTimeoutMs);
+        await sleep(Math.min(pollIntervalMs, remainingMs));
+    }
+}
+async function releaseIdentityLock(lock) {
+    try {
+        let raw;
+        try {
+            raw = await readFile(lock.path, "utf8");
+        }
+        catch (error) {
+            if (isNodeErrorWithCode(error, "ENOENT"))
+                return;
+            throw error;
+        }
+        let token;
+        try {
+            token = JSON.parse(raw).token;
+        }
+        catch {
+            return;
+        }
+        if (token !== lock.token)
+            return;
+        await unlink(lock.path);
+    }
+    finally {
+        await lock.handle.close();
+    }
+}
+function deferredRelease(error) {
+    if (typeof error !== "object" || error === null)
+        return null;
+    const settled = error[IDENTITY_LOCK_RELEASE_AFTER];
+    return settled instanceof Promise ? settled : null;
+}
+export async function withIdentityLock(directory, operation, options = {}) {
+    const lock = await acquireIdentityLock(directory, options);
+    let releaseWasDeferred = false;
+    try {
+        return await operation();
+    }
+    catch (error) {
+        const settled = deferredRelease(error);
+        if (settled) {
+            releaseWasDeferred = true;
+            void settled.then(() => releaseIdentityLock(lock), () => releaseIdentityLock(lock)).catch(() => undefined);
+        }
+        throw error;
+    }
+    finally {
+        if (!releaseWasDeferred)
+            await releaseIdentityLock(lock);
+    }
+}
+//# sourceMappingURL=identity-lock.js.map

package/dist/pairing/identity-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-lock.js","sourceRoot":"","sources":["../../src/pairing/identity-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAmB,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAWjF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,QAAQ,CAAS;IAE1B,YAAY,QAAgB,EAAE,aAAqB;QACjD,KAAK,CACH,kDAAkD,aAAa,SAAS,QAAQ,IAAI;YACpF,oFAAoF;YACpF,qFAAqF;YACrF,4FAA4F,CAC7F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAQD,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QAClE,KAA4B,CAAC,IAAI,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,SAAiB;IACpE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QACzG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,OAA4B;IAE5B,MAAM,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAEzD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAEtB,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,IAAI,WAAW,IAAI,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAClF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAsB;IACvD,IAAI,CAAC;QACH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,OAAO;YACjD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC,KAAK,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO;QACjC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAI,KAA8C,CAAC,2BAA2B,CAAC,CAAC;IAC7F,OAAO,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,SAA2B,EAC3B,UAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,kBAAkB,GAAG,IAAI,CAAC;YAC1B,KAAK,OAAO,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAC/B,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAChC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,kBAAkB;YAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/pairing/qr.d.ts

@@ -1,6 +1,5 @@
-export declare const PAIRING_INVITE_TTL_MS: number;
-export declare const PAIR_TTL_MIN_MS = 10000;
-export declare const PAIR_TTL_MAX_MS = 600000;
+import { PAIRING_INVITE_TTL_MS, PAIR_TTL_MAX_MS, PAIR_TTL_MIN_MS } from "../vendor/protocol/outer/index.js";
+export { PAIRING_INVITE_TTL_MS, PAIR_TTL_MAX_MS, PAIR_TTL_MIN_MS };
 export declare const PAIRING_CODE_LENGTH = 8;
 export declare const PAIRING_CODE_PATTERN: RegExp;
 export declare function clampPairTtlMs(ttlMs: number): number;

package/dist/pairing/qr.js

@@ -1,8 +1,7 @@
 import { randomBytes } from "node:crypto";
+import { PAIRING_INVITE_TTL_MS, PAIR_TTL_MAX_MS, PAIR_TTL_MIN_MS } from "../vendor/protocol/outer/index.js";
 import qrTerminal from "qrcode-terminal";
-export const PAIRING_INVITE_TTL_MS = 5 * 60_000;
-export const PAIR_TTL_MIN_MS = 10_000;
-export const PAIR_TTL_MAX_MS = 600_000;
+export { PAIRING_INVITE_TTL_MS, PAIR_TTL_MAX_MS, PAIR_TTL_MIN_MS };
 export const PAIRING_CODE_LENGTH = 8;
 export const PAIRING_CODE_PATTERN = /^[0-9A-HJKMNP-TV-Z]{8}$/;
 const CROCKFORD_BASE32 = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";

package/dist/pairing/qr.js.map

@@ -1 +1 @@
-{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../src/pairing/qr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,MAAM,CAAC;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAE5D,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC1D,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AA6BD,MAAM,OAAO,SAAS;IACZ,MAAM,GAAwB,IAAI,CAAC;IAE3C,YAAY;QACV,MAAM,MAAM,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAChD,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,IAAI,gBAAgB,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,QAAgB,qBAAqB;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,WAAW,CAAC,QAAgB,qBAAqB;QAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACtE,CAAC;IAED,WAAW,CAAc,IAAY,EAAE,OAAe,EAAE,SAAiB;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAElE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC7F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAChC,CAAC;YACD,oEAAoE;YACpE,2EAA2E;YAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACpC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAe,EAAE,CAAC;YACvE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACjE,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAEnD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;YACrG,oEAAoE;YACpE,uEAAuE;QACzE,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,EAAE,MAAM,KAAK,UAAU;YACjD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC7C,CAAC,CAAC,QAAQ,EAAE,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,WAAW,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IAED,UAAU,CAAI,WAA4B,EAAE,UAAa;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACxG,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACrF,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC;QAC3B,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,WAA4B;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACxG,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oBAAoB,CAAC,WAA4B;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,CAAC;QAClC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IACtK,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,UAAU,CAAC;QACvE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;AAEzC,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../src/pairing/qr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAE5D,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC1D,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AA6BD,MAAM,OAAO,SAAS;IACZ,MAAM,GAAwB,IAAI,CAAC;IAE3C,YAAY;QACV,MAAM,MAAM,GAAG,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAChD,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,IAAI,gBAAgB,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,QAAgB,qBAAqB;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,WAAW,CAAC,QAAgB,qBAAqB;QAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,eAAe;QACb,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACtE,CAAC;IAED,WAAW,CAAc,IAAY,EAAE,OAAe,EAAE,SAAiB;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAElE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC7F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAChC,CAAC;YACD,oEAAoE;YACpE,2EAA2E;YAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACpC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAe,EAAE,CAAC;YACvE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACjE,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAEnD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;YACrG,oEAAoE;YACpE,uEAAuE;QACzE,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,EAAE,MAAM,KAAK,UAAU;YACjD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC7C,CAAC,CAAC,QAAQ,EAAE,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,WAAW,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACzD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IAED,UAAU,CAAI,WAA4B,EAAE,UAAa;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACxG,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACrF,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC;QAC3B,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,WAA4B;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QACxG,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oBAAoB,CAAC,WAA4B;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,EAAE,WAAW,CAAC;QAClC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IACtK,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,UAAU,CAAC;QACvE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;AAEzC,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC"}

package/dist/pairing/storage.d.ts

@@ -1,78 +1,36 @@
 import { type Ed25519Keypair } from "./crypto.js";
+import { type KeyStoreBackend } from "./identity-keyring.js";
 export { addPeer, listPeers, listOwnerPubkeys, snapshotOwnerPubkeys, conditionalRemovePeer, conditionalRollbackPeer, removePeer, } from "./owner_storage.js";
 export type { PeerRecord, OwnerStorageToken, OwnerStorageSnapshotRecord, ConditionalPeerRemoval, PeerWriteReceipt, ConditionalPeerRollback, } from "./owner_storage.js";
-/** Raised when the keyring is unreadable on a platform where it's a core OS
- *  service (macOS Keychain, Windows Credential Manager) AND no prior file
- *  identity exists. We refuse to generate a NEW identity here because that
- *  would break existing pairing — the caller surfaces this so the user can
- *  unlock the keychain and retry instead of silently re-pairing. */
+export { _setKeyringOperationTimeoutForTest, _setNativeBindingErrorForTest, KeyringMutationTimeoutError, KeyringReadTimeoutError, } from "./identity-keyring.js";
+export type { KeyStoreBackend } from "./identity-keyring.js";
+export { IdentityLockTimeoutError } from "./identity-lock.js";
 export declare class KeyringUnavailableError extends Error {
     constructor(cause: unknown);
 }
-/** Raised when no identity can be resolved (keyring unreadable, no identity
- *  file) BUT `peers.json` already lists paired devices. Minting a fresh key
- *  here would make those existing pairings unusable — see issues #95 / #69. */
 export declare class PairedIdentityMissingError extends Error {
     constructor(pairedCount: number, cause: unknown);
 }
-/**
- * Minimal backend interface for credential reads/writes. Swappable so
- * tests can inject a controlled in-memory store without touching the OS
- * keyring (which is shared with the developer's own credentials).
- *
- * Errors thrown by `read`/`write`/`delete` signal "backend unavailable on
- * this platform" — callers fall back to the file store on first failure.
- * Returning `undefined` from `read` means "no such entry" (a normal,
- * non-error condition).
- */
-export interface KeyStoreBackend {
-    read(service: string, account: string): Promise<string | undefined>;
-    write(service: string, account: string, value: string): Promise<void>;
-    delete(service: string, account: string): Promise<boolean>;
+type IdentityFileErrorCategory = "read_failed" | "invalid_format";
+export declare class IdentityFileError extends Error {
+    readonly identityPath: string;
+    readonly category: IdentityFileErrorCategory;
+    constructor(identityPath: string, category: IdentityFileErrorCategory);
+}
+export declare class KeyringIdentityError extends Error {
+    readonly service: string;
+    constructor(service: string);
 }
-/** Test-only: force (or clear with `null`) a memoized binding-load failure, so
- *  the Bun/no-native-binding branch is reachable without a Bun host. */
-export declare function _setNativeBindingErrorForTest(err: unknown): void;
-/** Test-only: swap (or clear with `null`) the keyring backend. */
-export declare function _setKeyStoreBackendForTest(backend: KeyStoreBackend | null): void;
-/** Test-only: force `_keyringExpectedAvailable()` (so a darwin test host can
- *  exercise the Linux/headless branch and vice-versa). `null` restores the
- *  real platform check. */
+export declare function _setKeyStoreBackendForTest(value: KeyStoreBackend | null): void;
 export declare function _setKeyringExpectedForTest(value: boolean | null): void;
-/** Test-only: shrink retry attempts/delay so the persistent-failure path is
- *  fast. `null`/omitted restores defaults. */
 export declare function _setKeyringRetryForTest(attempts: number | null, delayMs?: number): void;
+export declare function _setIdentityLockTimingForTest(waitTimeoutMs: number | null, pollIntervalMs?: number): void;
 /**
- * Returns the Pi-secret Ed25519 keypair, generating + persisting one on
- * first call. Resolution order:
- *   1. Existing file `~/.pi/remote/identity.json`, if present — it WINS over
- *      the keyring. A file identity is only ever written by the headless/
- *      degraded fallback (step 4) or an explicit `REMOTE_PI_ALLOW_FILE_IDENTITY`
- *      opt-in, so its mere presence means this machine established its identity
- *      as a file and the browser PWA paired against THAT pubkey. If the
- *      platform keyring later becomes readable (D-Bus/libsecret installed, a
- *      desktop session, or a stale/other entry from another install), reading
- *      it first would mask the file identity — returning a DIFFERENT key, or
- *      (when the keyring is empty) minting a fresh one and persisting it —
- *      silently breaking the existing pairing. So when both exist, file wins.
- *   2. New keyring service `dev.remotepi.pi` (read retried — a transiently
- *      locked Keychain throws; we don't treat that as "no key")
- *   3. Old keyring service `dev.remotepi.mac` (migrate → step 2, delete old)
- *   4. Generate a fresh keypair, BUT only when it's safe to: either both
- *      keyring reads succeeded and returned nothing (genuine first run), or
- *      the keyring is genuinely unavailable on a platform without a core one
- *      (headless Linux → a file identity is minted here). On macOS/Windows a
- *      persistent read failure with no file identity throws
- *      `KeyringUnavailableError` instead of minting a new key — generating
- *      there silently breaks existing pairing (the "lost pairing after idle"
- *      bug). `REMOTE_PI_ALLOW_FILE_IDENTITY=1` opts back into a file identity
- *      for headless macOS/Windows hosts.
- *
- * Idempotent: subsequent calls return the same identity. The migration
- * runs at most once per machine (the old entry is deleted after copy).
+ * Returns the stable Host identity. Existing file identity wins; otherwise all
+ * keyring reads, migration, generation, and persistence run under the fixed
+ * cross-process identity lock. Every source is read again after lock acquisition.
  */
 export declare function getOrCreateEd25519Keypair(): Promise<Ed25519Keypair>;
-/** Test-only: expose the identity-file path so tests can clean it. */
 export declare const _IDENTITY_FILE_FOR_TEST: string;
-/** Test-only: expose unlink for cleanup. */
+export declare const _IDENTITY_LOCK_FILE_FOR_TEST: string;
 export declare const _unlinkIdentityFileForTest: () => Promise<void>;

package/dist/pairing/storage.js

@@ -1,391 +1,273 @@
-import { mkdir, readFile, writeFile, chmod, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { chmod, open, readFile, rename, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { generateEd25519Keypair } from "./crypto.js";
+import { ensurePrivateIdentityDirectory, withIdentityLock, } from "./identity-lock.js";
+import { NapiKeyringBackend, nativeBindingUnavailable, } from "./identity-keyring.js";
 import { listPeers } from "./owner_storage.js";
 export { addPeer, listPeers, listOwnerPubkeys, snapshotOwnerPubkeys, conditionalRemovePeer, conditionalRollbackPeer, removePeer, } from "./owner_storage.js";
-/**
- * Pi-secret storage (plan/27 Wave E1).
- *
- * The Ed25519 long-term identity of this Pi lives in the platform keyring
- * via `@napi-rs/keyring` (Keychain on macOS, libsecret on Linux desktop,
- * Credential Manager on Windows — DPAPI-backed). When the keyring is
- * unavailable (headless Linux without a D-Bus session, Docker containers,
- * VPS without GNOME Keyring/KWallet running) we fall back to a
- * file-backed store at `~/.pi/remote/identity.json` with `0o600`
- * permissions and the parent dir at `0o700`.
- *
- * **Migration**: previous builds used `keytar` against service
- * `dev.remotepi.mac`. This module reads from the old service if the new
- * service is empty, copies the entry to the new service `dev.remotepi.pi`,
- * and deletes the old one. Both keytar and `@napi-rs/keyring` address the
- * same OS-level credential store on every supported platform, so the read
- * succeeds without keeping the deprecated `keytar` dependency.
- */
-const NEW_SERVICE = "dev.remotepi.pi"; // platform-neutral
-const OLD_SERVICE = "dev.remotepi.mac"; // legacy keytar service (pre-2026-05-25)
+export { _setKeyringOperationTimeoutForTest, _setNativeBindingErrorForTest, KeyringMutationTimeoutError, KeyringReadTimeoutError, } from "./identity-keyring.js";
+export { IdentityLockTimeoutError } from "./identity-lock.js";
+const NEW_SERVICE = "dev.remotepi.pi";
+const OLD_SERVICE = "dev.remotepi.mac";
 const ACCOUNT = "longterm-ed25519";
-/**
- * The keyring read can THROW transiently rather than permanently — most
- * notably a macOS Keychain that's still locked right after login/wake (the
- * machine sat idle for days). Treating that throw as "backend unavailable"
- * and minting a fresh identity silently orphans the paired key (the
- * "lost pairing after a week idle" failure). So we retry the read a few times
- * before ever concluding the keyring is truly unavailable. Overridable for
- * tests via `_setKeyringRetryForTest`. */
-let _keyringReadAttempts = 3;
-let _keyringRetryDelayMs = 300;
-/** Raised when the keyring is unreadable on a platform where it's a core OS
- *  service (macOS Keychain, Windows Credential Manager) AND no prior file
- *  identity exists. We refuse to generate a NEW identity here because that
- *  would break existing pairing — the caller surfaces this so the user can
- *  unlock the keychain and retry instead of silently re-pairing. */
+const PI_DIR = join(homedir(), ".pi", "remote");
+const IDENTITY_FILE = join(PI_DIR, "identity.json");
+const IDENTITY_LOCK_FILE = join(PI_DIR, "identity.lock");
+let keyringReadAttempts = 3;
+let keyringRetryDelayMs = 300;
+let identityLockWaitTimeoutMs = 15_000;
+let identityLockPollIntervalMs = 50;
 export class KeyringUnavailableError extends Error {
     constructor(cause) {
         super("Platform keyring is unreadable and no file-backed identity exists. " +
-            "Refusing to generate a NEW identity (that would break existing " +
-            "pairing). Unlock your keychain / start your secret service and retry. " +
+            "Refusing to generate a NEW identity (that would break existing pairing). " +
+            "Unlock your keychain / start your secret service and retry. " +
             "Set REMOTE_PI_ALLOW_FILE_IDENTITY=1 to force a file-backed identity. " +
             `Cause: ${String(cause)}`);
         this.name = "KeyringUnavailableError";
     }
 }
-/** Raised when no identity can be resolved (keyring unreadable, no identity
- *  file) BUT `peers.json` already lists paired devices. Minting a fresh key
- *  here would make those existing pairings unusable — see issues #95 / #69. */
 export class PairedIdentityMissingError extends Error {
     constructor(pairedCount, cause) {
-        super(`No identity could be read, but ${pairedCount} device(s) are already ` +
-            "paired. Refusing to generate a NEW identity — that would revoke every " +
-            "paired device. This usually means this process cannot reach the same " +
-            "keyring as the session that paired (for example, a headless process vs. " +
-            "your desktop session). Fix the process keyring access, or pin the " +
-            "identity by copying the paired keypair to ~/.pi/remote/identity.json " +
-            "(0600), which both contexts read first. " +
+        super(`No identity could be read, but ${pairedCount} device(s) are already paired. ` +
+            "Refusing to generate a NEW identity - that would revoke every paired device. " +
+            "Fix this process's keyring access, or pin the established identity to " +
+            "~/.pi/remote/identity.json (0600). " +
             `Cause: ${String(cause)}`);
         this.name = "PairedIdentityMissingError";
     }
 }
-const PI_DIR = join(homedir(), ".pi", "remote");
-const IDENTITY_FILE = join(PI_DIR, "identity.json");
-/**
- * Per-operation timeout for native keyring calls (gnome-keyring / libsecret
- * via @napi-rs/keyring). A healthy secret service settles in milliseconds; 3s
- * is generous. The point is NOT speed — it is converting a HANG into a thrown
- * error. The native getPassword()/setPassword() can block indefinitely when
- * gnome-keyring waits on a GUI authorization prompt that cannot be shown in
- * a headless / tmux / non-interactive context. A hang never settles, so
- * without this guard the promise never rejects and the retry + file-fallback
- * logic in getOrCreateEd25519Keypair() is unreachable — freezing the entire
- * /remote-pi pair bootstrap. Raising a real error here lets that fallback
- * chain run as designed.
- */
-const KEYRING_OP_TIMEOUT_MS = 3_000;
-function _withTimeout(p, op, ms = KEYRING_OP_TIMEOUT_MS) {
-    return Promise.race([
-        p,
-        new Promise((_, reject) => setTimeout(() => reject(new Error(`keyring ${op} timed out after ${ms}ms`)), ms)),
-    ]);
-}
-/**
- * Lazily loaded `@napi-rs/keyring` binding — issue #113.
- *
- * A STATIC `import { AsyncEntry } from "@napi-rs/keyring"` is evaluated when
- * the extension module is loaded, so a native binding that cannot be resolved
- * takes the WHOLE extension down at load time ("Failed to load extension …:
- * Cannot find native binding"). That happens on a Bun-compiled `pi`: the
- * loader's first branch (`require("./keyring.<triple>.node")`) is fine, but its
- * fallback (`require("@napi-rs/keyring-<triple>")`, a bare package whose `main`
- * IS the .node file) resolves under Node and not under Bun — and the message it
- * prints then blames npm's optional-dependency bug, sending users off to delete
- * node_modules and losing their other pi packages.
- *
- * Loading on first use turns that fatal load error into an ordinary backend
- * failure, which the existing retry + file-identity fallback already handles.
- */
-let _asyncEntryCtor = null;
-let _nativeBindingError = null;
-async function _loadAsyncEntry() {
-    if (_asyncEntryCtor)
-        return _asyncEntryCtor;
-    if (_nativeBindingError)
-        throw _nativeBindingError;
-    try {
-        const mod = await import("@napi-rs/keyring");
-        _asyncEntryCtor = mod.AsyncEntry;
-        return _asyncEntryCtor;
+export class IdentityFileError extends Error {
+    identityPath;
+    category;
+    constructor(identityPath, category) {
+        super(`Identity file at ${identityPath} is unsafe to use (${category}). Refusing to replace it.`);
+        this.name = "IdentityFileError";
+        this.identityPath = identityPath;
+        this.category = category;
     }
-    catch (err) {
-        _nativeBindingError = err;
-        throw err;
-    }
-}
-/**
- * Did the native binding fail to LOAD (as opposed to an operation failing)?
- *
- * A load failure is deterministic and platform-wide: no retry, no unlock, no
- * amount of waiting brings the keyring back in this process. So it must NOT be
- * treated like a transiently locked Keychain — on macOS/Windows that would
- * throw `KeyringUnavailableError` and leave the user with no working path at
- * all. The file-identity fallback (with its loud warning) is the only usable
- * route here, exactly as on headless Linux.
- */
-function _nativeBindingUnavailable() {
-    return _nativeBindingError !== null;
 }
-/** Test-only: force (or clear with `null`) a memoized binding-load failure, so
- *  the Bun/no-native-binding branch is reachable without a Bun host. */
-export function _setNativeBindingErrorForTest(err) {
-    _asyncEntryCtor = null;
-    _nativeBindingError = err;
-}
-class NapiKeyringBackend {
-    async read(service, account) {
-        const AsyncEntry = await _loadAsyncEntry();
-        const entry = new AsyncEntry(service, account);
-        return _withTimeout(entry.getPassword(), `read(${service})`); // undefined on no-entry
-    }
-    async write(service, account, value) {
-        const AsyncEntry = await _loadAsyncEntry();
-        const entry = new AsyncEntry(service, account);
-        await _withTimeout(entry.setPassword(value), `write(${service})`);
-    }
-    async delete(service, account) {
-        let entry;
-        try {
-            const AsyncEntry = await _loadAsyncEntry();
-            entry = new AsyncEntry(service, account);
-        }
-        catch {
-            return false;
-        }
-        try {
-            return await _withTimeout(entry.deleteCredential(), `delete(${service})`);
-        }
-        catch {
-            return false;
-        }
+export class KeyringIdentityError extends Error {
+    service;
+    constructor(service) {
+        super(`Stored identity in platform keyring service ${service} is invalid. Refusing to replace it.`);
+        this.name = "KeyringIdentityError";
+        this.service = service;
     }
 }
-let _backend = null;
-function _getBackend() {
-    if (!_backend)
-        _backend = new NapiKeyringBackend();
-    return _backend;
+let backend = null;
+let keyringExpectedOverride = null;
+function getBackend() {
+    if (!backend)
+        backend = new NapiKeyringBackend();
+    return backend;
 }
-/** Test-only: swap (or clear with `null`) the keyring backend. */
-export function _setKeyStoreBackendForTest(backend) {
-    _backend = backend;
+export function _setKeyStoreBackendForTest(value) {
+    backend = value;
 }
-/**
- * Is the platform keyring a CORE OS service we should expect to be present?
- * macOS (Keychain) and Windows (Credential Manager) always have one, so a read
- * that throws there is transient/locked, NOT "headless" — we must not mint a
- * new identity. On Linux/other the secret service may be genuinely absent
- * (headless, no D-Bus), so the documented file fallback applies. Overridable
- * for tests via `_setKeyringExpectedForTest`. */
-let _keyringExpectedOverride = null;
-function _keyringExpectedAvailable() {
-    if (_keyringExpectedOverride !== null)
-        return _keyringExpectedOverride;
-    // Binding never loaded (Bun-built pi, issue #113) → there is no keyring on
-    // this platform *for this process*, whatever the OS normally offers.
-    if (_nativeBindingUnavailable())
+function keyringExpectedAvailable() {
+    if (keyringExpectedOverride !== null)
+        return keyringExpectedOverride;
+    if (nativeBindingUnavailable())
         return false;
     return process.platform === "darwin" || process.platform === "win32";
 }
-/** Test-only: force `_keyringExpectedAvailable()` (so a darwin test host can
- *  exercise the Linux/headless branch and vice-versa). `null` restores the
- *  real platform check. */
 export function _setKeyringExpectedForTest(value) {
-    _keyringExpectedOverride = value;
+    keyringExpectedOverride = value;
 }
-/** Test-only: shrink retry attempts/delay so the persistent-failure path is
- *  fast. `null`/omitted restores defaults. */
 export function _setKeyringRetryForTest(attempts, delayMs) {
-    _keyringReadAttempts = attempts ?? 3;
-    _keyringRetryDelayMs = delayMs ?? 300;
+    keyringReadAttempts = attempts ?? 3;
+    keyringRetryDelayMs = delayMs ?? 300;
+}
+export function _setIdentityLockTimingForTest(waitTimeoutMs, pollIntervalMs) {
+    identityLockWaitTimeoutMs = waitTimeoutMs ?? 15_000;
+    identityLockPollIntervalMs = pollIntervalMs ?? 50;
 }
-function _sleep(ms) {
-    return ms > 0 ? new Promise((r) => setTimeout(r, ms)) : Promise.resolve();
+function sleep(ms) {
+    return ms > 0 ? new Promise((resolve) => setTimeout(resolve, ms)) : Promise.resolve();
 }
-function _serialize(kp) {
+function serialize(kp) {
     const payload = {
         pk: Buffer.from(kp.publicKey).toString("base64"),
         sk: Buffer.from(kp.secretKey).toString("base64"),
     };
     return JSON.stringify(payload);
 }
-function _deserialize(stored) {
+function decodeCanonicalBase64(value, field) {
+    if (typeof value !== "string" || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+        throw new Error(`invalid ${field}`);
+    }
+    const decoded = Buffer.from(value, "base64");
+    if (decoded.toString("base64") !== value)
+        throw new Error(`invalid ${field}`);
+    return decoded;
+}
+function deserializeUnsafe(stored) {
     const parsed = JSON.parse(stored);
-    return {
-        publicKey: Buffer.from(parsed.pk, "base64"),
-        secretKey: Buffer.from(parsed.sk, "base64"),
-    };
+    const publicKey = decodeCanonicalBase64(parsed.pk, "pk");
+    const secretKey = decodeCanonicalBase64(parsed.sk, "sk");
+    if (publicKey.length !== 32 || (secretKey.length !== 32 && secretKey.length !== 64))
+        throw new Error("invalid key length");
+    return { publicKey, secretKey };
+}
+function deserializeKeyringIdentity(stored, service) {
+    try {
+        return deserializeUnsafe(stored);
+    }
+    catch {
+        throw new KeyringIdentityError(service);
+    }
+}
+function isNodeErrorWithCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error &&
+        error.code === code;
 }
-// ── File fallback (headless Linux) ──────────────────────────────────────────
-async function _readKeypairFromFile() {
+async function readKeypairFromFile() {
+    let raw;
     try {
-        const raw = await readFile(IDENTITY_FILE, "utf8");
-        return _deserialize(raw);
+        raw = await readFile(IDENTITY_FILE, "utf8");
+    }
+    catch (error) {
+        if (isNodeErrorWithCode(error, "ENOENT"))
+            return null;
+        throw new IdentityFileError(IDENTITY_FILE, "read_failed");
+    }
+    try {
+        return deserializeUnsafe(raw);
     }
     catch {
-        return null;
+        throw new IdentityFileError(IDENTITY_FILE, "invalid_format");
     }
 }
-async function _writeKeypairToFile(kp) {
-    await mkdir(PI_DIR, { recursive: true, mode: 0o700 });
-    // Best-effort tighten of the dir in case it pre-existed with looser
-    // permissions (mkdir's mode is only applied to NEW dirs).
+async function syncIdentityDirectory() {
+    if (process.platform === "win32")
+        return;
+    const directory = await open(PI_DIR, "r");
     try {
-        await chmod(PI_DIR, 0o700);
+        await directory.sync();
+    }
+    finally {
+        await directory.close();
     }
-    catch { /* not fatal */ }
-    await writeFile(IDENTITY_FILE, _serialize(kp), { mode: 0o600 });
+}
+async function writeKeypairToFile(kp) {
+    await ensurePrivateIdentityDirectory(PI_DIR);
+    const temporaryPath = join(PI_DIR, `.identity.json.${process.pid}.${randomUUID()}.tmp`);
+    let handle = null;
+    let published = false;
     try {
+        handle = await open(temporaryPath, "wx", 0o600);
+        await handle.writeFile(serialize(kp), "utf8");
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        await rename(temporaryPath, IDENTITY_FILE);
+        published = true;
         await chmod(IDENTITY_FILE, 0o600);
+        await syncIdentityDirectory();
+    }
+    finally {
+        if (handle)
+            await handle.close().catch(() => undefined);
+        if (!published) {
+            await unlink(temporaryPath).catch((error) => {
+                if (!isNodeErrorWithCode(error, "ENOENT"))
+                    throw error;
+            });
+        }
     }
-    catch { /* not fatal */ }
 }
-// ── Public API ──────────────────────────────────────────────────────────────
-/**
- * Returns the Pi-secret Ed25519 keypair, generating + persisting one on
- * first call. Resolution order:
- *   1. Existing file `~/.pi/remote/identity.json`, if present — it WINS over
- *      the keyring. A file identity is only ever written by the headless/
- *      degraded fallback (step 4) or an explicit `REMOTE_PI_ALLOW_FILE_IDENTITY`
- *      opt-in, so its mere presence means this machine established its identity
- *      as a file and the browser PWA paired against THAT pubkey. If the
- *      platform keyring later becomes readable (D-Bus/libsecret installed, a
- *      desktop session, or a stale/other entry from another install), reading
- *      it first would mask the file identity — returning a DIFFERENT key, or
- *      (when the keyring is empty) minting a fresh one and persisting it —
- *      silently breaking the existing pairing. So when both exist, file wins.
- *   2. New keyring service `dev.remotepi.pi` (read retried — a transiently
- *      locked Keychain throws; we don't treat that as "no key")
- *   3. Old keyring service `dev.remotepi.mac` (migrate → step 2, delete old)
- *   4. Generate a fresh keypair, BUT only when it's safe to: either both
- *      keyring reads succeeded and returned nothing (genuine first run), or
- *      the keyring is genuinely unavailable on a platform without a core one
- *      (headless Linux → a file identity is minted here). On macOS/Windows a
- *      persistent read failure with no file identity throws
- *      `KeyringUnavailableError` instead of minting a new key — generating
- *      there silently breaks existing pairing (the "lost pairing after idle"
- *      bug). `REMOTE_PI_ALLOW_FILE_IDENTITY=1` opts back into a file identity
- *      for headless macOS/Windows hosts.
- *
- * Idempotent: subsequent calls return the same identity. The migration
- * runs at most once per machine (the old entry is deleted after copy).
- */
-export async function getOrCreateEd25519Keypair() {
-    const backend = _getBackend();
-    // ── Path 0: an existing file-backed identity wins ──────────────────────
-    // `~/.pi/remote/identity.json` is only ever written by the headless/degraded
-    // fallback below (or an operator who set REMOTE_PI_ALLOW_FILE_IDENTITY=1) —
-    // never on a keyring-backed install. So its presence means THIS machine
-    // paired against the file key, and the keyring (readable or not, matching or
-    // not) must not be allowed to mask it. Short-circuit before touching the
-    // keyring so a keyring that later comes online can't return a different key,
-    // nor mint a fresh one over the file identity. No file → normal keyring
-    // resolution below; a headless first run still reaches Path B and mints one.
-    const existingFile = await _readKeypairFromFile();
-    if (existingFile)
-        return existingFile;
-    // ── Path A: keyring (retried) ──────────────────────────────────────────
-    // A throw here means the keyring op FAILED — but on macOS/Windows that is
-    // almost always a transiently locked Keychain (idle/just-woke machine), not
-    // a missing backend. `read` returns `undefined` for "no such entry" (the
-    // genuine first-run signal). So we retry on throw, and only a throw that
-    // SURVIVES every attempt drops us to Path B.
+async function assertGenerationIsSafe(forceFile, cause) {
+    if (forceFile)
+        return;
+    const paired = await listPeers();
+    if (paired.length > 0)
+        throw new PairedIdentityMissingError(paired.length, cause);
+}
+async function resolveKeyringReads(store) {
     let keyringError;
-    for (let attempt = 0; attempt < _keyringReadAttempts; attempt++) {
+    for (let attempt = 0; attempt < keyringReadAttempts; attempt++) {
         try {
-            const existing = await backend.read(NEW_SERVICE, ACCOUNT);
+            const existing = await store.read(NEW_SERVICE, ACCOUNT);
             if (existing)
-                return _deserialize(existing);
-            const legacy = await backend.read(OLD_SERVICE, ACCOUNT);
-            if (legacy) {
-                const kp = _deserialize(legacy);
-                await backend.write(NEW_SERVICE, ACCOUNT, legacy);
-                await backend.delete(OLD_SERVICE, ACCOUNT);
-                // Silent migration: writing the chat surface would be premature
-                // (Pi SDK isn't bound yet at this point in boot) and console
-                // output bleeds outside the TUI. The presence of an entry under
-                // NEW_SERVICE is itself the audit signal — re-running migration
-                // is idempotent and harmless.
-                return kp;
-            }
-            // Both reads SUCCEEDED and returned nothing → genuine first run on a
-            // working keyring. Generate and save to the new service.
-            const fresh = generateEd25519Keypair();
-            await backend.write(NEW_SERVICE, ACCOUNT, _serialize(fresh));
-            return fresh;
+                return { resolution: { kind: "new", stored: existing }, error: undefined };
+            const legacy = await store.read(OLD_SERVICE, ACCOUNT);
+            if (legacy)
+                return { resolution: { kind: "legacy", stored: legacy }, error: undefined };
+            return { resolution: { kind: "empty" }, error: undefined };
         }
-        catch (err) {
-            keyringError = err;
-            if (attempt < _keyringReadAttempts - 1) {
-                // Linear backoff — a locked Keychain usually frees within seconds.
-                await _sleep(_keyringRetryDelayMs * (attempt + 1));
+        catch (error) {
+            keyringError = error;
+            if (attempt < keyringReadAttempts - 1) {
+                await sleep(keyringRetryDelayMs * (attempt + 1));
             }
         }
     }
-    // ── Path B: keyring threw on every attempt ─────────────────────────────
-    // Path 0 already returned any pre-existing file identity; this defensive
-    // re-check catches a file written concurrently by another Pi process during
-    // the keyring-retry window (still: use it, never regenerate).
-    const fromFile = await _readKeypairFromFile();
+    return { resolution: null, error: keyringError };
+}
+async function getOrCreateUnderLock() {
+    const existingFile = await readKeypairFromFile();
+    if (existingFile)
+        return existingFile;
+    const store = getBackend();
+    const { resolution, error: keyringError } = await resolveKeyringReads(store);
+    const forceFile = process.env.REMOTE_PI_ALLOW_FILE_IDENTITY === "1";
+    if (resolution?.kind === "new") {
+        return deserializeKeyringIdentity(resolution.stored, NEW_SERVICE);
+    }
+    if (resolution?.kind === "legacy") {
+        const keypair = deserializeKeyringIdentity(resolution.stored, OLD_SERVICE);
+        await store.write(NEW_SERVICE, ACCOUNT, resolution.stored);
+        await store.delete(OLD_SERVICE, ACCOUNT);
+        return keypair;
+    }
+    if (resolution?.kind === "empty") {
+        await assertGenerationIsSafe(forceFile, undefined);
+        const fresh = generateEd25519Keypair();
+        await store.write(NEW_SERVICE, ACCOUNT, serialize(fresh));
+        return fresh;
+    }
+    const fromFile = await readKeypairFromFile();
     if (fromFile)
         return fromFile;
-    // No file identity AND the keyring is unreadable. CRITICAL FORK:
-    //
-    //  - On a platform without a guaranteed keyring (headless Linux, no D-Bus),
-    //    minting a file-backed identity is the documented, correct first-run
-    //    behavior.
-    //  - On macOS/Windows the keyring is a core OS service, so a persistent read
-    //    failure means it's LOCKED/denied — NOT that we're a fresh install.
-    //    Generating a new key here is exactly what silently broke pairing after
-    //    a week idle, and the new key then masks the real Keychain identity via
-    //    the file. So we FAIL LOUD instead, unless the operator explicitly
-    //    opts into a file identity.
-    const forceFile = process.env.REMOTE_PI_ALLOW_FILE_IDENTITY === "1";
-    if (_keyringExpectedAvailable() && !forceFile) {
+    if (keyringExpectedAvailable() && !forceFile) {
         throw new KeyringUnavailableError(keyringError);
     }
-    // Issues #95 / #69 — minting a NEW identity when Owners are already paired
-    // is destructive on every platform. A separate process can resolve a
-    // different secret store than the interactive process which created the machine key; a fresh
-    // identity would no longer authenticate as the paired Host. Keep peers.json
-    // intact and fail loudly so the operator can restore access or pin the
-    // established identity to the file-backed store.
-    if (!forceFile) {
-        const paired = await listPeers();
-        if (paired.length > 0) {
-            throw new PairedIdentityMissingError(paired.length, keyringError);
-        }
-    }
-    console.warn(_nativeBindingUnavailable()
-        // Issue #113: the @napi-rs/keyring native binding could not be loaded at
-        // all (typically a Bun-compiled pi). Name it explicitly — the error the
-        // loader prints blames npm's optional-dependency bug and sends people off
-        // to delete node_modules, which takes their other pi packages with it.
+    await assertGenerationIsSafe(forceFile, keyringError);
+    console.warn(nativeBindingUnavailable()
         ? "[remote-pi] @napi-rs/keyring native binding could not be loaded in this " +
-            `runtime; using file-backed identity at ${IDENTITY_FILE} (0600) instead. ` +
-            "This is expected on a Bun-built pi. Paired devices keyed to a previous " +
-            `keyring identity must be re-paired. ${String(keyringError)}`
+            `runtime; using file-backed identity at ${IDENTITY_FILE} (0600) instead. ${String(keyringError)}`
         : "[remote-pi] keyring unavailable; using file-backed identity at " +
             `${IDENTITY_FILE}. ${String(keyringError)}`);
     const fresh = generateEd25519Keypair();
-    await _writeKeypairToFile(fresh);
+    await writeKeypairToFile(fresh);
     return fresh;
 }
-// ── Test-only helpers ────────────────────────────────────────────────────────
-/** Test-only: expose the identity-file path so tests can clean it. */
+/**
+ * Returns the stable Host identity. Existing file identity wins; otherwise all
+ * keyring reads, migration, generation, and persistence run under the fixed
+ * cross-process identity lock. Every source is read again after lock acquisition.
+ */
+export async function getOrCreateEd25519Keypair() {
+    const existingFile = await readKeypairFromFile();
+    if (existingFile)
+        return existingFile;
+    return withIdentityLock(PI_DIR, getOrCreateUnderLock, {
+        waitTimeoutMs: identityLockWaitTimeoutMs,
+        pollIntervalMs: identityLockPollIntervalMs,
+    });
+}
 export const _IDENTITY_FILE_FOR_TEST = IDENTITY_FILE;
-/** Test-only: expose unlink for cleanup. */
+export const _IDENTITY_LOCK_FILE_FOR_TEST = IDENTITY_LOCK_FILE;
 export const _unlinkIdentityFileForTest = async () => {
     try {
         await unlink(IDENTITY_FILE);
     }
-    catch { /* fine if missing */ }
+    catch (error) {
+        if (!isNodeErrorWithCode(error, "ENOENT"))
+            throw error;
+    }
 };
 //# sourceMappingURL=storage.js.map

package/dist/pairing/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/pairing/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAuB,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EACL,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAU5B;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,GAAG,iBAAiB,CAAC,CAAE,mBAAmB;AAC3D,MAAM,WAAW,GAAG,kBAAkB,CAAC,CAAC,yCAAyC;AACjF,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC;;;;;;;0CAO0C;AAC1C,IAAI,oBAAoB,GAAG,CAAC,CAAC;AAC7B,IAAI,oBAAoB,GAAG,GAAG,CAAC;AAE/B;;;;oEAIoE;AACpE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,KAAc;QACxB,KAAK,CACH,qEAAqE;YACrE,iEAAiE;YACjE,wEAAwE;YACxE,uEAAuE;YACvE,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;+EAE+E;AAC/E,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,WAAmB,EAAE,KAAc;QAC7C,KAAK,CACH,kCAAkC,WAAW,yBAAyB;YACtE,wEAAwE;YACxE,uEAAuE;YACvE,0EAA0E;YAC1E,oEAAoE;YACpE,uEAAuE;YACvE,0CAA0C;YAC1C,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAoBpD;;;;;;;;;;;GAWG;AACH,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,SAAS,YAAY,CACnB,CAAa,EACb,EAAU,EACV,KAAa,qBAAqB;IAElC,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC3B,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CACjF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,IAAI,eAAe,GAAwD,IAAI,CAAC;AAChF,IAAI,mBAAmB,GAAY,IAAI,CAAC;AAExC,KAAK,UAAU,eAAe;IAC5B,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,IAAI,mBAAmB;QAAE,MAAM,mBAAmB,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,eAAe,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,OAAO,eAAe,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,GAAG,GAAG,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB;IAChC,OAAO,mBAAmB,KAAK,IAAI,CAAC;AACtC,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,6BAA6B,CAAC,GAAY;IACxD,eAAe,GAAG,IAAI,CAAC;IACvB,mBAAmB,GAAG,GAAG,CAAC;AAC5B,CAAC;AAED,MAAM,kBAAkB;IACtB,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAe;QACzC,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,OAAO,GAAG,CAAC,CAAC,CAAE,wBAAwB;IACzF,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa;QACzD,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,IAAI,KAAiE,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC3C,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,UAAU,OAAO,GAAG,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,IAAI,QAAQ,GAA2B,IAAI,CAAC;AAE5C,SAAS,WAAW;IAClB,IAAI,CAAC,QAAQ;QAAE,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACnD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,0BAA0B,CAAC,OAA+B;IACxE,QAAQ,GAAG,OAAO,CAAC;AACrB,CAAC;AAED;;;;;;iDAMiD;AACjD,IAAI,wBAAwB,GAAmB,IAAI,CAAC;AACpD,SAAS,yBAAyB;IAChC,IAAI,wBAAwB,KAAK,IAAI;QAAE,OAAO,wBAAwB,CAAC;IACvE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,yBAAyB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACvE,CAAC;AAED;;2BAE2B;AAC3B,MAAM,UAAU,0BAA0B,CAAC,KAAqB;IAC9D,wBAAwB,GAAG,KAAK,CAAC;AACnC,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,uBAAuB,CAAC,QAAuB,EAAE,OAAgB;IAC/E,oBAAoB,GAAG,QAAQ,IAAI,CAAC,CAAC;IACrC,oBAAoB,GAAG,OAAO,IAAI,GAAG,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,EAAU;IACxB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AAC5E,CAAC;AASD,SAAS,UAAU,CAAC,EAAkB;IACpC,MAAM,OAAO,GAAsB;QACjC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChD,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACjD,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,oBAAoB;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,EAAkB;IACnD,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oEAAoE;IACpE,0DAA0D;IAC1D,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AACtE,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,YAAY,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAClD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,YAAqB,CAAC;IAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,oBAAoB,EAAE,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,QAAQ;gBAAE,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBAChC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAClD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAC3C,gEAAgE;gBAChE,6DAA6D;gBAC7D,gEAAgE;gBAChE,gEAAgE;gBAChE,8BAA8B;gBAC9B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,qEAAqE;YACrE,yDAAyD;YACzD,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;YACvC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,GAAG,CAAC;YACnB,IAAI,OAAO,GAAG,oBAAoB,GAAG,CAAC,EAAE,CAAC;gBACvC,mEAAmE;gBACnE,MAAM,MAAM,CAAC,oBAAoB,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,iEAAiE;IACjE,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,eAAe;IACf,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG,CAAC;IACpE,IAAI,yBAAyB,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,2EAA2E;IAC3E,qEAAqE;IACrE,6FAA6F;IAC7F,4EAA4E;IAC5E,uEAAuE;IACvE,iDAAiD;IACjD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CACV,yBAAyB,EAAE;QACzB,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,CAAC,CAAC,0EAA0E;YAC1E,0CAA0C,aAAa,mBAAmB;YAC1E,yEAAyE;YACzE,uCAAuC,MAAM,CAAC,YAAY,CAAC,EAAE;QAC/D,CAAC,CAAC,iEAAiE;YACjE,GAAG,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAChD,CAAC;IACF,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AACrD,4CAA4C;AAC5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,IAAmB,EAAE;IAClE,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;AACtE,CAAC,CAAC"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/pairing/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAmB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAuB,MAAM,aAAa,CAAC;AAC1E,OAAO,EACL,8BAA8B,EAE9B,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,wBAAwB,GAEzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EACL,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAS5B,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,MAAM,OAAO,GAAG,kBAAkB,CAAC;AACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAChD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AACpD,MAAM,kBAAkB,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAEzD,IAAI,mBAAmB,GAAG,CAAC,CAAC;AAC5B,IAAI,mBAAmB,GAAG,GAAG,CAAC;AAC9B,IAAI,yBAAyB,GAAG,MAAM,CAAC;AACvC,IAAI,0BAA0B,GAAG,EAAE,CAAC;AAEpC,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,KAAc;QACxB,KAAK,CACH,qEAAqE;YACrE,2EAA2E;YAC3E,8DAA8D;YAC9D,uEAAuE;YACvE,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,WAAmB,EAAE,KAAc;QAC7C,KAAK,CACH,kCAAkC,WAAW,iCAAiC;YAC9E,+EAA+E;YAC/E,wEAAwE;YACxE,qCAAqC;YACrC,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAID,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,YAAY,CAAS;IACrB,QAAQ,CAA4B;IAE7C,YAAY,YAAoB,EAAE,QAAmC;QACnE,KAAK,CAAC,oBAAoB,YAAY,sBAAsB,QAAQ,4BAA4B,CAAC,CAAC;QAClG,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,OAAO,CAAS;IAEzB,YAAY,OAAe;QACzB,KAAK,CAAC,+CAA+C,OAAO,sCAAsC,CAAC,CAAC;QACpG,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,IAAI,OAAO,GAA2B,IAAI,CAAC;AAC3C,IAAI,uBAAuB,GAAmB,IAAI,CAAC;AAEnD,SAAS,UAAU;IACjB,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACjD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAA6B;IACtE,OAAO,GAAG,KAAK,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB;IAC/B,IAAI,uBAAuB,KAAK,IAAI;QAAE,OAAO,uBAAuB,CAAC;IACrE,IAAI,wBAAwB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAqB;IAC9D,uBAAuB,GAAG,KAAK,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAuB,EAAE,OAAgB;IAC/E,mBAAmB,GAAG,QAAQ,IAAI,CAAC,CAAC;IACpC,mBAAmB,GAAG,OAAO,IAAI,GAAG,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,aAA4B,EAAE,cAAuB;IACjG,yBAAyB,GAAG,aAAa,IAAI,MAAM,CAAC;IACpD,0BAA0B,GAAG,cAAc,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AACxF,CAAC;AAOD,SAAS,SAAS,CAAC,EAAkB;IACnC,MAAM,OAAO,GAAsB;QACjC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChD,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACjD,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAA8B;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,kEAAkE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IAC9E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA+B,CAAC;IAChE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC3H,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc,EAAE,OAAe;IACjE,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QAClE,KAA4B,CAAC,IAAI,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,EAAkB;IAClD,MAAM,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACxF,IAAI,MAAM,GAAsB,IAAI,CAAC;IACrC,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAC3C,SAAS,GAAG,IAAI,CAAC;QACjB,MAAM,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,qBAAqB,EAAE,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACnD,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;oBAAE,MAAM,KAAK,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,SAAkB,EAAE,KAAc;IACtE,IAAI,SAAS;QAAE,OAAO;IACtB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpF,CAAC;AAOD,KAAK,UAAU,mBAAmB,CAAC,KAAsB;IAIvD,IAAI,YAAqB,CAAC;IAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,mBAAmB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,QAAQ;gBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAEzF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACtD,IAAI,MAAM;gBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACxF,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,GAAG,KAAK,CAAC;YACrB,IAAI,OAAO,GAAG,mBAAmB,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,KAAK,CAAC,mBAAmB,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,MAAM,YAAY,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACjD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG,CAAC;IAEpE,IAAI,UAAU,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,0BAA0B,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,UAAU,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;QACvC,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC7C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,wBAAwB,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,sBAAsB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEtD,OAAO,CAAC,IAAI,CACV,wBAAwB,EAAE;QACxB,CAAC,CAAC,0EAA0E;YAC1E,0CAA0C,aAAa,oBAAoB,MAAM,CAAC,YAAY,CAAC,EAAE;QACnG,CAAC,CAAC,iEAAiE;YACjE,GAAG,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAChD,CAAC;IACF,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,YAAY,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACjD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,OAAO,gBAAgB,CACrB,MAAM,EACN,oBAAoB,EACpB;QACE,aAAa,EAAE,yBAAyB;QACxC,cAAc,EAAE,0BAA0B;KAC3C,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AACrD,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;AAC/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,IAAmB,EAAE;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAC;IACzD,CAAC;AACH,CAAC,CAAC"}

package/dist/vendor/protocol/constants.d.ts

@@ -1 +1,4 @@
 export declare const PROTOCOL_VERSION: 2;
+export declare const PAIRING_INVITE_TTL_MS = 300000;
+export declare const PAIR_TTL_MIN_MS = 10000;
+export declare const PAIR_TTL_MAX_MS = 300000;

package/dist/vendor/protocol/constants.js

@@ -1 +1,4 @@
 export const PROTOCOL_VERSION = 2;
+export const PAIRING_INVITE_TTL_MS = 300_000;
+export const PAIR_TTL_MIN_MS = 10_000;
+export const PAIR_TTL_MAX_MS = 300_000;

package/dist/vendor/protocol/outer/index.d.ts

@@ -1,4 +1,4 @@
-export { PROTOCOL_VERSION } from "../constants.js";
+export { PAIRING_INVITE_TTL_MS, PAIR_TTL_MAX_MS, PAIR_TTL_MIN_MS, PROTOCOL_VERSION, } from "../constants.js";
 export * from "../encoding.js";
 export * from "./types.js";
 export * from "./codec.js";

package/dist/vendor/protocol/outer/index.js

@@ -1,4 +1,4 @@
-export { PROTOCOL_VERSION } from "../constants.js";
+export { PAIRING_INVITE_TTL_MS, PAIR_TTL_MAX_MS, PAIR_TTL_MIN_MS, PROTOCOL_VERSION, } from "../constants.js";
 export * from "../encoding.js";
 export * from "./types.js";
 export * from "./codec.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yefengr/remote-pi",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "publishConfig": {
     "access": "public"
   },