made-bridge 0.0.0-stage → 0.2.0

package/src/language-settings.mjs

@@ -0,0 +1,38 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export const DEFAULT_LOCALE = 'zh-CN';
+export function validateLocale(locale) {
+  if (locale !== 'zh-CN' && locale !== 'en') throw new Error('语言仅支持 zh-CN 或 en');
+  return locale;
+}
+export function loadLanguageSettings(stateDir, fallback = DEFAULT_LOCALE) {
+  const initial = validateLocale(fallback);
+  if (!stateDir) return initial;
+  try {
+    const file = path.join(stateDir, 'language-settings.json');
+    if (!fs.lstatSync(file).isFile()) throw new Error('语言设置文件无效');
+    const saved = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return validateLocale(saved?.locale);
+  } catch (error) {
+    if (error.code === 'ENOENT') return initial;
+    throw error;
+  }
+}
+export function saveLanguageSettings(config, payload) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload) ||
+      Object.keys(payload).some(key => key !== 'locale')) throw new Error('语言设置格式无效');
+  const locale = validateLocale(payload.locale);
+  const directory = config.stateDir;
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const file = path.join(directory, 'language-settings.json');
+  const temporary = path.join(directory, `.language-settings-${process.pid}-${randomUUID()}`);
+  try {
+    fs.writeFileSync(temporary, JSON.stringify({ locale }), { flag: 'wx', mode: 0o600 });
+    fs.renameSync(temporary, file);
+  } finally { fs.rmSync(temporary, { force: true }); }
+  // Only update the live locale after the durable write succeeds.
+  config.locale = locale;
+  return { locale };
+}

package/src/model-settings.mjs

@@ -0,0 +1,63 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+export const DEFAULT_CODEX_MODEL = 'gpt-6-astra';
+const DEFAULT_MODEL_AGENTS = [
+  { id: 'codex', capabilities: {model: true}, model: {required: true} },
+  { id: 'cursor', capabilities: {model: true} }, { id: 'qoder', capabilities: {model: true} },
+];
+export const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:/+@\[\],=-]{0,119}$/;
+
+export function validateModelSettings(value, registry) {
+  const agents = (registry?.agents() || DEFAULT_MODEL_AGENTS).filter(p => p.capabilities.model);
+  if (!value || typeof value !== 'object' || Array.isArray(value) ||
+      Object.keys(value).length !== agents.length || !agents.every(p => Object.hasOwn(value, p.id))) {
+    throw new Error('请填写当前已安装助手的模型设置');
+  }
+  return validateStoredModels(value, new Set(agents.filter(p => p.model?.required).map(p => p.id)));
+}
+
+export function validateStoredModels(value, required = new Set()) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('模型设置格式无效');
+  const models = {};
+  for (const [provider, model] of Object.entries(value)) {
+    if (!/^[a-z0-9][a-z0-9_-]{0,39}$/.test(provider) || ['constructor','prototype','__proto__'].includes(provider) ||
+        typeof model !== 'string' || (!model && required.has(provider)) || (model && !MODEL_ID.test(model))) {
+      throw new Error(`${provider} 模型名称无效`);
+    }
+    models[provider] = model;
+  }
+  return models;
+}
+
+function settingsPath(stateDir) {
+  return path.join(stateDir, 'models.json');
+}
+
+export function loadModelSettings(stateDir) {
+  const file = settingsPath(stateDir);
+  try {
+    if (!fs.lstatSync(file).isFile()) throw new Error('模型设置文件无效');
+    return validateStoredModels(JSON.parse(fs.readFileSync(file, 'utf8')));
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+export function saveModelSettings(stateDir, value, registry) {
+  const validated = validateModelSettings(value, registry);
+  const models = { ...(loadModelSettings(stateDir) || {}), ...validated };
+  fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+  const file = settingsPath(stateDir);
+  const temporary = path.join(stateDir, `.models-${process.pid}-${randomUUID()}`);
+  try {
+    fs.writeFileSync(temporary, JSON.stringify(models), { flag: 'wx', mode: 0o600 });
+    fs.renameSync(temporary, file);
+    fs.chmodSync(file, 0o600);
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
+  return models;
+}

package/src/openai-key.mjs

@@ -0,0 +1,47 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+function secretPaths(stateDir) {
+  const directory = path.join(stateDir, 'secrets');
+  return { directory, file: path.join(directory, 'openai-api-key') };
+}
+
+export function loadOpenAIKey(stateDir) {
+  const { file } = secretPaths(stateDir);
+  try {
+    if (!fs.lstatSync(file).isFile()) throw new Error('密钥存储文件无效');
+    const key = fs.readFileSync(file, 'utf8').trim();
+    if (!key || key.length > 512 || /\s/.test(key)) throw new Error('本机保存的 OpenAI 密钥格式无效');
+    return key;
+  } catch (error) {
+    if (error.code === 'ENOENT') return '';
+    throw error;
+  }
+}
+
+export function validateOpenAIKey(value) {
+  if (typeof value !== 'string' || value.length > 512 || (value && (value !== value.trim() || /\s/.test(value)))) {
+    throw new Error('语音 API Key 格式无效');
+  }
+  return value;
+}
+
+export function saveOpenAIKey(stateDir, value) {
+  validateOpenAIKey(value);
+  const { directory, file } = secretPaths(stateDir);
+  if (value === '') {
+    fs.rmSync(file, { force: true });
+    return;
+  }
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  fs.chmodSync(directory, 0o700);
+  const temporary = path.join(directory, `.openai-api-key-${process.pid}-${randomUUID()}`);
+  try {
+    fs.writeFileSync(temporary, value, { flag: 'wx', mode: 0o600 });
+    fs.renameSync(temporary, file);
+    fs.chmodSync(file, 0o600);
+  } finally {
+    fs.rmSync(temporary, { force: true });
+  }
+}

package/src/oray.mjs

@@ -0,0 +1,243 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { isIP } from 'node:net';
+
+const ORAY_API = 'https://hsk-api.oray.com';
+const API_TIMEOUT_MS = 8000;
+const PROBE_TIMEOUT_MS = 5000;
+
+function privateFile(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  const temporary = `${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  fs.writeFileSync(temporary, value, { mode: 0o600 });
+  fs.renameSync(temporary, file);
+  fs.chmodSync(file, 0o600);
+}
+
+function validateApiKey(value) {
+  if (typeof value !== 'string' || value.length < 16 || value.length > 2048 ||
+      !/^[A-Za-z0-9._-]+$/.test(value)) {
+    throw new Error('花生壳 API Key 格式无效');
+  }
+  return value;
+}
+
+export function normalizeOrayDomain(value) {
+  if (typeof value !== 'string' || value.length > 260) throw new Error('请输入花生壳 HTTPS 域名');
+  const trimmed = value.trim();
+  let parsed;
+  try { parsed = new URL(trimmed.includes('://') ? trimmed : `https://${trimmed}`); }
+  catch { throw new Error('请输入花生壳 HTTPS 域名'); }
+  const hostname = parsed.hostname.toLowerCase();
+  const labels = hostname.split('.');
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.port ||
+      parsed.pathname !== '/' || parsed.search || parsed.hash || hostname.length > 253 ||
+      labels.length < 2 || isIP(hostname) || labels.some((label) =>
+        !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))) {
+    throw new Error('花生壳地址须为 HTTPS 域名，不含端口、路径或参数');
+  }
+  return hostname;
+}
+
+function mapRecord(record) {
+  if (!record || typeof record !== 'object') return null;
+  const domain = typeof record.domain === 'string' ? record.domain.toLowerCase() : '';
+  return {
+    domain,
+    port: Number(record.port),
+    fwtype: Number(record.fwtype),
+    servicehost: String(record.servicehost ?? ''),
+    serviceport: Number(record.serviceport),
+    isforbid: record.isforbid,
+    memo: typeof record.memo === 'string' ? record.memo : '',
+  };
+}
+
+function targetMatches(record, domain, devicePort) {
+  return record.domain === domain && record.port === 443 && record.fwtype === 3 &&
+    record.servicehost === '127.0.0.1' && record.serviceport === devicePort &&
+    typeof record.isforbid === 'boolean';
+}
+
+export class OrayManager {
+  constructor({ devicePort, stateDir, bridgeId, fetchImpl = fetch }) {
+    if (!Number.isInteger(devicePort) || devicePort < 1 || devicePort > 65535) {
+      throw new Error('设备接口端口无效');
+    }
+    this.devicePort = devicePort;
+    this.bridgeId = bridgeId;
+    this.fetchImpl = fetchImpl;
+    this.settingsFile = stateDir ? path.join(stateDir, 'oray-settings.json') : null;
+    this.apiKeyFile = stateDir ? path.join(stateDir, 'oray-apikey') : null;
+    this.domain = null;
+    if (this.settingsFile) {
+      try { this.domain = normalizeOrayDomain(JSON.parse(fs.readFileSync(this.settingsFile, 'utf8')).domain); }
+      catch { /* Saved settings cannot enable a public mapping on their own. */ }
+    }
+    this.status = 'off';
+    this.url = null;
+    this.error = '';
+    this.mappingEnabled = false;
+    this.busy = false;
+  }
+
+  get apiKeyConfigured() {
+    try { return Boolean(this.apiKeyFile && validateApiKey(fs.readFileSync(this.apiKeyFile, 'utf8').trim())); }
+    catch { return false; }
+  }
+
+  summary() {
+    return { status: this.status, url: this.url, error: this.error, domain: this.domain,
+      mappingEnabled: this.mappingEnabled, apiKeyConfigured: this.apiKeyConfigured };
+  }
+
+  configure({ domain, apiKey, clearApiKey = false } = {}) {
+    if (this.busy || this.mappingEnabled) throw new Error('请先停用已选花生壳映射，再修改设置');
+    if (typeof clearApiKey !== 'boolean' || (clearApiKey && apiKey)) throw new Error('API Key 设置冲突');
+    const nextDomain = domain === undefined ? this.domain : normalizeOrayDomain(domain);
+    const nextKey = apiKey ? validateApiKey(apiKey) : null;
+    if (!this.settingsFile || !this.apiKeyFile) throw new Error('桥接器未配置状态目录');
+    if (nextKey) privateFile(this.apiKeyFile, nextKey);
+    else if (clearApiKey) fs.rmSync(this.apiKeyFile, { force: true });
+    privateFile(this.settingsFile, JSON.stringify({ domain: nextDomain }, null, 2));
+    this.domain = nextDomain;
+    this.status = 'off';
+    this.url = null;
+    this.error = '';
+    return this.summary();
+  }
+
+  async apiRequest(method, route, data = undefined) {
+    if (!this.apiKeyConfigured) throw new Error('请先保存花生壳 API Key');
+    const secret = validateApiKey(fs.readFileSync(this.apiKeyFile, 'utf8').trim());
+    let response;
+    try {
+      response = await this.fetchImpl(`${ORAY_API}${route}`, {
+        method, redirect: 'error', signal: AbortSignal.timeout(API_TIMEOUT_MS),
+        headers: { Authorization: `apikey ${secret}`, ...(data === undefined ? {} : { 'content-type': 'application/json' }) },
+        ...(data === undefined ? {} : { body: JSON.stringify(data) }),
+      });
+    } catch { throw new Error('无法连接花生壳开放 API，请检查网络'); }
+    if (response.status === 401 || response.status === 403) throw new Error('花生壳 API Key 无效或无权限');
+    if (!response.ok) throw new Error(`花生壳开放 API 返回 ${response.status}，请检查账号服务及映射配置`);
+    if (response.status === 204) return null;
+    try { return await response.json(); }
+    catch { throw new Error('花生壳开放 API 返回的数据无效'); }
+  }
+
+  async listMappings() {
+    const records = await this.apiRequest('GET', '/openapi/v2/mapping/list');
+    if (!Array.isArray(records)) throw new Error('花生壳映射列表格式无效');
+    return records.map(mapRecord).filter(Boolean);
+  }
+
+  async selectedMapping() {
+    if (!this.domain) throw new Error('请先选择花生壳 HTTPS 域名');
+    const candidates = (await this.listMappings()).filter((record) =>
+      record.domain === this.domain && record.port === 443 && record.fwtype === 3);
+    if (candidates.length !== 1) {
+      throw new Error('未找到唯一的 HTTPS/443 映射，请先在花生壳创建并选择该域名');
+    }
+    const mapping = candidates[0];
+    if (!targetMatches(mapping, this.domain, this.devicePort)) {
+      throw new Error(`花生壳映射须指向本机 127.0.0.1:${this.devicePort}，已拒绝操作其他服务`);
+    }
+    return mapping;
+  }
+
+  async setEnabled(enabled) {
+    const service = await this.apiRequest('GET', '/openapi/api/forward/service');
+    const userId = Number(service?.userid);
+    if (!Number.isSafeInteger(userId) || userId < 1) throw new Error('无法读取花生壳账号 ID');
+    await this.apiRequest('POST', `/openapi/api/mapping/${userId}/forbid/${enabled ? 'off' : 'on'}`,
+      { domain: this.domain, port: 443, fwtype: 3 });
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      if (attempt > 0) await new Promise((resolve) => setTimeout(resolve, 350));
+      const mapping = await this.selectedMapping();
+      this.mappingEnabled = !mapping.isforbid;
+      if (this.mappingEnabled === enabled) return;
+    }
+    throw new Error('花生壳映射状态尚未更新，请稍后刷新状态');
+  }
+
+  async publicProbe() {
+    if (typeof this.bridgeId !== 'string' || !this.bridgeId) throw new Error('桥接器身份尚未准备好');
+    const nonce = randomBytes(16).toString('hex');
+    let response;
+    try {
+      response = await this.fetchImpl(`https://${this.domain}/device/tunnel-probe?nonce=${nonce}`,
+        { redirect: 'error', cache: 'no-store', signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+    } catch { return false; }
+    if (!response.ok) return false;
+    try {
+      const proof = await response.json();
+      return proof?.nonce === nonce && proof.bridgeId === this.bridgeId &&
+        proof.authority === this.domain;
+    } catch { return false; }
+  }
+
+  fail(error) {
+    this.status = 'error';
+    this.url = null;
+    this.error = error instanceof Error ? error.message : String(error);
+    return this.summary();
+  }
+
+  async refresh() {
+    if (this.busy) return this.summary();
+    this.busy = true;
+    try {
+      const mapping = await this.selectedMapping();
+      this.mappingEnabled = !mapping.isforbid;
+      if (!this.mappingEnabled) {
+        this.status = 'off';
+        this.url = null;
+        this.error = '';
+      } else if (await this.publicProbe()) {
+        this.status = 'online';
+        this.url = `https://${this.domain}`;
+        this.error = '';
+      } else {
+        this.fail(new Error('映射已启用，但无法验证公网地址指向本桥接器；请检查花生壳客户端已登录且映射保留公网 Host'));
+      }
+      return this.summary();
+    } catch (error) { return this.fail(error); }
+    finally { this.busy = false; }
+  }
+
+  async start() {
+    if (this.busy) return this.summary();
+    this.busy = true;
+    this.status = 'starting';
+    this.url = null;
+    this.error = '';
+    try {
+      const mapping = await this.selectedMapping();
+      this.mappingEnabled = !mapping.isforbid;
+      if (!this.mappingEnabled) await this.setEnabled(true);
+      if (!(await this.publicProbe())) {
+        return this.fail(new Error('映射已启用，但无法验证公网地址指向本桥接器；请检查花生壳客户端已登录且映射保留公网 Host'));
+      }
+      this.status = 'online';
+      this.url = `https://${this.domain}`;
+      return this.summary();
+    } catch (error) { return this.fail(error); }
+    finally { this.busy = false; }
+  }
+
+  async stop() {
+    if (this.busy) return this.summary();
+    this.busy = true;
+    try {
+      const mapping = await this.selectedMapping();
+      this.mappingEnabled = !mapping.isforbid;
+      if (this.mappingEnabled) await this.setEnabled(false);
+      this.status = 'off';
+      this.url = null;
+      this.error = '';
+      return this.summary();
+    } catch (error) { return this.fail(error); }
+    finally { this.busy = false; }
+  }
+}

package/src/pairing.mjs

@@ -0,0 +1,203 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
+import { isIP } from 'node:net';
+
+const ID = /^[0-9a-f]{12}$/;
+const CODE = /^[0-9]{6}$/;
+const NONCE = /^[0-9a-f]{32}$/;
+const PENDING_MS = 120_000;
+const APPROVED_RETRY_MS = 60_000;
+const PAIRED_DISCOVERY = 'VIBE_BRIDGE_PAIRED_V2';
+const MANUAL_VERIFICATION = 'VIBE_BRIDGE_MANUAL_V2';
+
+function writePrivate(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  const temporary = `${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+  fs.writeFileSync(temporary, JSON.stringify(value, null, 2), { mode: 0o600 });
+  fs.renameSync(temporary, file);
+  fs.chmodSync(file, 0o600);
+}
+
+function safeEqual(received, expected) {
+  if (typeof received !== 'string' || typeof expected !== 'string') return false;
+  const left = Buffer.from(received);
+  const right = Buffer.from(expected);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+
+export class PairingStore {
+  constructor(stateDir) {
+    this.file = path.join(stateDir, 'paired-devices.json');
+    this.idFile = path.join(stateDir, 'bridge-id.json');
+    this.pending = new Map();
+    this.paired = new Map();
+    this.persistedSeenAt = new Map();
+    this.requestTimes = new Map();
+    this.verifyTimes = new Map();
+    this.activeUntil = 0;
+    if (fs.existsSync(this.file)) {
+      try {
+        const saved = JSON.parse(fs.readFileSync(this.file, 'utf8'));
+        for (const item of saved) {
+          if (ID.test(item.deviceId) && /^[0-9a-f]{64}$/.test(item.token)) {
+            this.paired.set(item.deviceId, item);
+            this.persistedSeenAt.set(item.deviceId, Date.parse(item.lastSeen) || 0);
+          }
+        }
+      } catch { /* A damaged state file never authorizes a device. */ }
+    }
+    try {
+      const saved = JSON.parse(fs.readFileSync(this.idFile, 'utf8'));
+      if (/^[A-Za-z0-9_-]{1,64}$/.test(saved.bridgeId)) this.bridgeId = saved.bridgeId;
+    } catch { /* Create an ID for the first run. */ }
+    if (!this.bridgeId) {
+      this.bridgeId = randomUUID();
+      writePrivate(this.idFile, { bridgeId: this.bridgeId });
+    }
+  }
+
+  open(seconds = 120) {
+    this.activeUntil = Date.now() + Math.min(Math.max(seconds, 1), 300) * 1000;
+    return this.summary();
+  }
+
+  close() {
+    this.activeUntil = 0;
+    // Closing the pairing window stops new requests, but an approved device
+    // may still be retrying after a lost HTTP response.
+    for (const [id, item] of this.pending) {
+      if (item.status !== 'approved') this.pending.delete(id);
+    }
+    return this.summary();
+  }
+
+  prune() {
+    const now = Date.now();
+    for (const [id, item] of this.pending) {
+      if (now > item.expiresAt) this.pending.delete(id);
+    }
+  }
+
+  summary() {
+    this.prune();
+    return {
+      open: Date.now() < this.activeUntil,
+      openUntil: this.activeUntil,
+      pending: [...this.pending.values()].filter((item) => item.status === 'pending').map(({ deviceId, deviceName, code, nonce, expiresAt, endpoint }) => ({ deviceId, deviceName, code, nonce, expiresAt, endpoint })),
+      paired: [...this.paired.values()].map(({ deviceId, deviceName, pairedAt, lastSeen }) => ({
+        deviceId, deviceName, pairedAt, lastSeen,
+        online: Number.isFinite(Date.parse(lastSeen)) && Date.now() - Date.parse(lastSeen) <= 30_000,
+      })),
+    };
+  }
+
+  request(input, address, endpoint = '') {
+    const { deviceId, deviceName, code, nonce } = input || {};
+    if (!ID.test(deviceId) || !CODE.test(code) || !NONCE.test(nonce)) throw new Error('配对请求格式无效');
+    if (typeof deviceName !== 'string' || deviceName.length > 80) throw new Error('设备名称无效');
+    this.prune();
+    const prior = this.pending.get(deviceId);
+    if (prior && safeEqual(prior.nonce, nonce) && prior.address === address) return { status: prior.status };
+    if (Date.now() >= this.activeUntil) throw new Error('电脑配对窗口未开启');
+    if (this.pending.size >= 8) throw new Error('待配对设备过多');
+    const recent = (this.requestTimes.get(address) || []).filter((time) => Date.now() - time < 60_000);
+    if (recent.length >= 10) throw new Error('配对尝试过于频繁');
+    recent.push(Date.now());
+    this.requestTimes.set(address, recent);
+    this.pending.set(deviceId, {
+      deviceId, deviceName, code, nonce, address, endpoint,
+      status: 'pending', expiresAt: Math.min(Date.now() + PENDING_MS, this.activeUntil),
+    });
+    return { status: 'pending' };
+  }
+
+  status(deviceId, nonce, address) {
+    this.prune();
+    const item = this.pending.get(deviceId);
+    if (!item || !safeEqual(item.nonce, nonce) || item.address !== address) return { status: 'expired' };
+    if (item.status === 'approved') {
+      return { status: 'approved', token: item.token, bridgeId: this.bridgeId };
+    }
+    if (item.status === 'denied') {
+      this.pending.delete(deviceId);
+      return { status: 'denied' };
+    }
+    return { status: 'pending' };
+  }
+
+  decide(deviceId, nonce, action) {
+    this.prune();
+    const item = this.pending.get(deviceId);
+    if (!item || !safeEqual(item.nonce, nonce) || item.status !== 'pending') throw new Error('配对请求已失效');
+    if (action === 'reject') {
+      item.status = 'denied';
+    } else {
+      item.status = 'approved';
+      item.token = randomBytes(32).toString('hex');
+      item.expiresAt = Date.now() + APPROVED_RETRY_MS;
+      const now = new Date().toISOString();
+      this.paired.set(deviceId, { deviceId, deviceName: item.deviceName, token: item.token, pairedAt: now, lastSeen: now });
+      this.persistedSeenAt.set(deviceId, Date.now());
+      writePrivate(this.file, [...this.paired.values()]);
+      this.activeUntil = 0;
+    }
+    return this.summary();
+  }
+
+  remove(deviceId) {
+    if (!this.paired.delete(deviceId)) throw new Error('设备未配对');
+    this.persistedSeenAt.delete(deviceId);
+    this.pending.delete(deviceId);
+    writePrivate(this.file, [...this.paired.values()]);
+    return this.summary();
+  }
+
+  deviceIdForToken(token) {
+    if (!this.authenticate(token)) return null;
+    for (const item of this.paired.values()) {
+      if (safeEqual(item.token, token)) return item.deviceId;
+    }
+    return null;
+  }
+
+  authenticate(token) {
+    if (typeof token !== 'string' || !/^[0-9a-f]{64}$/.test(token)) return false;
+    for (const item of this.paired.values()) {
+      if (safeEqual(item.token, token)) {
+        const now = Date.now();
+        item.lastSeen = new Date(now).toISOString();
+        if (now - (this.persistedSeenAt.get(item.deviceId) || 0) >= 60_000) {
+          writePrivate(this.file, [...this.paired.values()]);
+          this.persistedSeenAt.set(item.deviceId, now);
+        }
+        return true;
+      }
+    }
+    return false;
+  }
+
+  signedDiscoveryReply(deviceId, nonce, port, serverIPv4) {
+    const paired = this.paired.get(deviceId);
+    if (!paired || !NONCE.test(nonce) || !Number.isInteger(port) || port < 1 || port > 65535 ||
+        isIP(serverIPv4) !== 4) return null;
+    const signed = [PAIRED_DISCOVERY, deviceId, nonce, String(port), this.bridgeId, serverIPv4].join('\n');
+    const mac = createHmac('sha256', Buffer.from(paired.token, 'hex')).update(signed, 'ascii').digest('hex');
+    return `${PAIRED_DISCOVERY} ${port} ${this.bridgeId} ${serverIPv4} ${mac}`;
+  }
+
+  verifyManual(deviceId, nonce, address, authority) {
+    if (!ID.test(deviceId || '') || !NONCE.test(nonce || '')) return null;
+    if (typeof authority !== 'string' || authority.length > 253 || !authority) return null;
+    const now = Date.now();
+    const recent = (this.verifyTimes.get(address) || []).filter((time) => now - time < 60_000);
+    if (recent.length >= 60) throw new Error('校验请求过于频繁');
+    recent.push(now);
+    this.verifyTimes.set(address, recent);
+    const paired = this.paired.get(deviceId);
+    if (!paired) return null;
+    const signed = [MANUAL_VERIFICATION, deviceId, nonce, this.bridgeId, authority].join('\n');
+    const mac = createHmac('sha256', Buffer.from(paired.token, 'hex')).update(signed, 'ascii').digest('hex');
+    return { bridgeId: this.bridgeId, authority, mac };
+  }
+}